编号撤回

Npm mixme is an application from the American company Npm. It is used to recursively merge multiple objects. The last object takes precedence over previous objects. A security vulnerability exists in Npm mixme version v0.5.0, which can be exploited by an attacker to add or modify properties of an...

GHSA-7WPW-2HJM-89GP Prototype Pollution in merge

All versions of package merge 2.1.1 are vulnerable to Prototype Pollution via recursiveMerge...

Prototype Pollution

Overview tree-kit is a Tree utilities which provides a full-featured extend and object-cloning facility, and various tools to deal with nested object structures. Affected versions of this package are vulnerable to Prototype Pollution via dotPath.set. PoC: const dotPath = require'tree-kit'...

Prototype Pollution

Overview merge-deep is a recursively merges values in a javascript object. Affected versions of this package are vulnerable to Prototype Pollution. Merge-deep actively attempts to prevent prototype pollution by blocking object property merges into proto, however it still allows for prototype...

Prototype Pollution

Overview @lyngs/digger is an Use digger to value, from deep inside of an . Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const digger = require"@lyngs/digger"; console.log'Prototype before dig', .isAdmin; digger, 'proto.isAdmin', true,...

Prototype Pollution

Overview nested-object-assign is a Package to support nested merging of objects & properties, using Object.Assign Affected versions of this package are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below. PoC // poc.js const assign =...

Prototype Pollution

Overview multi-ini is an ini-file parser which supports multi line, multiple levels and arrays to get a maximum of compatibility with Zend config files. Affected versions of this package are vulnerable to Prototype Pollution. It is possible to pollute an object's prototype by specifying the...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The vulnerability is in the extend function. PoC const decal = require'decal'; console.log'Before:', .polluted; const o = JSON.parse'"proto":"polluted":"1"'; decal.extend, true, o; console.log'After:', .polluted;...

Prototype Pollution

Overview jiff is a JSON diff and patch based on rfc6902 Affected versions of this package are vulnerable to Prototype Pollution. When the operation specified is 'add', the function adds in the target object the property specified in the path, however it does not properly check the key being set,...

Prototype Pollution

Overview merge is a library that allows you to merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser. Affected versions of this package are vulnerable to Prototype Pollution via recursiveMerge...

Prototype Pollution

Overview json8 is a JSON toolkit for JavaScript Affected versions of this package are vulnerable to Prototype Pollution. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution. Details...

Prototype Pollution

Overview mathjs is a math library for JavaScript and Node.js. It features a flexible expression parser with support for symbolic computation, comes with a large set of built-in functions and constants, and offers an integrated solution to work with diff. Affected versions of this package are...

Prototype Pollution

Overview mout is a Modular Utilities Affected versions of this package are vulnerable to Prototype Pollution. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'...

Prototype Pollution

Overview promisehelpers is a Promise helper functions Affected versions of this package are vulnerable to Prototype Pollution via the insert function. POC: const promisehelpers = require'promisehelpers'; var obj = ; promisehelpers.insert'proto', 'polluted', trueobj; console.logpolluted; // true...

Prototype Pollution

Overview nodee-utils is a set of useful helpers Affected versions of this package are vulnerable to Prototype Pollution via the deepSet function. POC: const object = require'nodee-utils'; object.deepSet, 'proto.polluted', true; console.logpolluted; Details Prototype Pollution is a vulnerability...

Prototype Pollution

Overview objutil is a Javascript Object util methods with deep traverse, with ES6 tree shaking methods. Affected versions of this package are vulnerable to Prototype Pollution. The merge method could be tricked into adding or modifying properties of Object.prototype. PoC var a = x:1,y: w:1, z:2 v...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC by Snyk angular.merge, JSON.parse'"proto": "xxx": "polluted"'; console.log.xxx; Details Prototyp...

Prototype Pollution

Overview lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor...

Prototype Pollution

Overview fast-json-patch is a leaner and meaner implementation of JSON-Patch. Affected versions of this package are vulnerable to Prototype Pollution via applyPatch and applyOperation in fast-json-patch.js. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution...

Prototype Pollution

Overview lodash.defaultsdeep is a Lodash method .defaultsDeep exported as a Node.js module. Affected versions of this package are vulnerable to Prototype Pollution. The functions merge, mergeWith, and defaultsDeep could be tricked into adding or modifying properties of Object.prototype. This is d...