Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNmOTUtdzVoNS1mcTg2
Prototype Pollution in mergify
All versions of mergify are vulnerable to Prototype Pollution. The mergify() function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.
Recommendation
No fix is currently available. Consider using an alternative module as the package is deprecated.
Permalink: https://github.com/advisories/GHSA-3f95-w5h5-fq86JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNmOTUtdzVoNS1mcTg2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: over 1 year ago
Identifiers: GHSA-3f95-w5h5-fq86
References:
- https://hackerone.com/reports/439098
- https://www.npmjs.com/advisories/995
- https://github.com/advisories/GHSA-3f95-w5h5-fq86
Affected Packages
npm:mergify
Dependent packages: 1Dependent repositories: 1
Downloads: 3 last month
Affected Version Ranges: >= 0
No known fixed version
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3