valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.
References:MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBtcHItdmM1cS1oM2p3
Exposure of Resource to Wrong Sphere in valib
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
|
npm:valib
PURL:
pkg:npm/valib
|
<= 2.0.0 | No known fixed version | |
Affected Version RangesAll affected versions1.0.0, 2.0.0 |
|||