GitHub Advisoryadvisory · npm

GHSA-vr5m-3h59-7jcp Prototype Pollution in think-helper

HIGH Published 2021-07-01 Modified 2022-05-26 Official page ↗
Aliases
CVE-2021-32736
Ecosystem
npm
Packages
think-helper
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-06-30

Affected packages

• npm think-helper: < 1.1.3 → fixed in 1.1.3

Description

Impact The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. Patches `[email protected]` patched it, anyone used `think-helper` should upgrade to `>=1.1.3` version. References https://cwe.mitre.org/data/definitions/1321.html For more information If you have any questions or comments about this advisory: • Open an issue in thinkjs/thinkjs • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-32736 think-helper defines a set of helper functions for ThinkJS. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References