Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZwODItMmg5OS0zZnBw

Prototype Pollution in async merge-object

The utilities function in all versions of the merge-object node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Permalink: https://github.com/advisories/GHSA-fp82-2h99-3fpp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZwODItMmg5OS0zZnBw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 5 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-fp82-2h99-3fpp, CVE-2018-3753
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-3753
• https://hackerone.com/reports/310706
• https://github.com/advisories/GHSA-fp82-2h99-3fpp

Blast Radius: 3.0

Affected Packages