GitHub Advisoryadvisory · npm

GHSA-wxgw-qj99-44c2 Prototype Pollution in node-forge util.setPath API

LOW Published 2022-01-08 Modified 2022-01-07 Official page ↗
Ecosystem
npm
Packages
node-forge
Severity
Low
Reviewed
2022-01-07

Affected packages

• npm node-forge: < 0.10.0 → fixed in 0.10.0

Description

Impact `forge.util.setPath` had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself. Patches The `forge.util.setPath` API and related functions were removed in 0.10.0. Workarounds Don't call `forge.util.setPath` directly or indirectly with untrusted keys. References • https://security.snyk.io/vuln/SNYK-JS-NODEFORGE-598677 • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720 For more information If you have any questions or comments about this advisory: • Open an issue in forge. • Email us at [email protected].

References