Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01OGcyLTlmcXItMzZxMs0VjQ

Prototype Pollution in Proto

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.

Permalink: https://github.com/advisories/GHSA-58g2-9fqr-36q2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01OGcyLTlmcXItMzZxMs0VjQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-58g2-9fqr-36q2, CVE-2021-23426
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-23426
• https://snyk.io/vuln/SNYK-JS-PROTO-1316301
• https://www.npmjs.com/package/Proto
• https://github.com/advisories/GHSA-58g2-9fqr-36q2

Blast Radius: 0.0

Affected Packages