Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1mbTkzLWZoaDItY2cyY80lsA

Prototype Pollution in min-dash

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.

Permalink: https://github.com/advisories/GHSA-fm93-fhh2-cg2c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mbTkzLWZoaDItY2cyY80lsA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 3 years ago
Updated: almost 2 years ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00672
EPSS Percentile: 0.80064

Identifiers: GHSA-fm93-fhh2-cg2c, CVE-2021-23460
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-23460
• https://github.com/bpmn-io/min-dash/pull/21
• https://github.com/bpmn-io/min-dash/pull/21/commits/5ab05cbc4fd8d5eafb7db540c491ed0906b9d320
• https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js%23L32
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2342127
• https://snyk.io/vuln/SNYK-JS-MINDASH-2340605
• https://github.com/advisories/GHSA-fm93-fhh2-cg2c

Repository: https://github.com/bpmn-io/min-dash
Blast Radius: 21.9

Affected Packages