GitHub Advisoryadvisory · npm, Packagist

GHSA-v9p9-535w-4285 Prototype Pollution in litespeed.js and appwrite/server-ce

CRITICAL Published 2022-02-17 Modified 2022-02-25 Official page ↗
Aliases
CVE-2021-23682
Ecosystem
npm, Packagist
Packages
litespeed.js, appwrite/server-ce
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2022-02-17

Affected packages

• npm litespeed.js: < 0.3.12 → fixed in 0.3.12 • Packagist appwrite/server-ce: >= 0.12.0, < 0.12.2 → fixed in 0.12.2 • Packagist appwrite/server-ce: < 0.11.1 → fixed in 0.11.1

Description

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.

Related

Alias · CVE (1)

  • CVE-2021-23682 This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References