Prototype Pollution

Overview putil-merge is a Lightweight solution for merging multiple objects into one. Also it supports deep merge. Affected versions of this package are vulnerable to Prototype Pollution. The merge function does not check the values passed into the argument. An attacker can supply a malicious val...

Denial of Service (DoS)

Overview bignum is an Arbitrary precision integral arithmetic for Node.js using OpenSSL. This library is based on node-bigint by substack, but instead of using libgmp, it uses the builtin bignum functionality provided by OpenSSL. The advantage is that OpenSSL is already part of Node.js, so this...

Prototype Pollution

Overview set-in is a set value of nested associative structure given array of keys Affected versions of this package are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of...

Prototype Pollution

Overview deep-get-set is a Set and get values on objects via dot-notation strings. Affected versions of this package are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715 POC: js let deep = require'deep-get-set';...

GHSA-GJM5-83CW-P3P2 Prototype Pollution in extend2

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...

CVE-2021-23568

CVE-2021-23568 affects the JavaScript package extend2 (versions before 1.0.1). The vulnerability is a Prototype Pollution in the extend function caused by unsafe recursive merge, enabling an attacker to inject properties (such as proto ) into Object.prototype, potentially leading to DoS or remote...

Prototype Pollution

Overview extend2 is a forked from node-extend, the difference is overriding array as primitive when deep clone. Affected versions of this package are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge. POC: js var e = require "extend2" etrue, ,...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype. PoC js var jsgui=require'jsgui-lang-essentials'; var obj=; console.log"start: " +...

Prototype Pollution

Overview @cookiex/deep is a Tool to assign properties recursively and create recursion features in an easy way. Affected versions of this package are vulnerable to Prototype Pollution. The global proto object can be polluted using the proto object. PoC var deep = require"@cookiex/deep" const targ...

Prototype Pollution

Overview com.graphhopper:graphhopper-web-bundle is a GraphHopper routing engine as a web-service Affected versions of this package are vulnerable to Prototype Pollution. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or proto payload. P...

Prototype Pollution

Overview record-like-deep-assign is a Recursively assigns enumerable own properties of the given sources to a target object Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const deepAssign = require'record-like-deep-assign'; let obj = ;...

Prototype Pollution

Overview lutils is an A few reliable utils. Affected versions of this package are vulnerable to Prototype Pollution via the main merge function. PoC const lt = require'lutils'; let obj = ; console.log"Before being polluted: " + obj.polluted; var EVILJSON = JSON.parse'"proto":"polluted":true';...

Prototype Pollution

Overview @ianwalter/merge is a Recursively merge JavaScript Objects Affected versions of this package are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead. PoC const merge = require'@ianwalter/merge'; let obj = ; console.log"Before...

Prototype Pollution

Overview merge-change is a Deep merge of objects and other types, also for patches and immutable updates. Affected versions of this package are vulnerable to Prototype Pollution via the utils.set function. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution...

Prototype Pollution

Overview nedb is an embedded persistent or in memory database for Node.js, nw.js, Electron and browsers, 100% JavaScript, no binary dependency. Affected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of...

编号撤回

Npm mixme is an application from the American company Npm. It is used to recursively merge multiple objects. The last object takes precedence over previous objects. A security vulnerability exists in Npm mixme version v0.5.0, which can be exploited by an attacker to add or modify properties of an...

GHSA-7WPW-2HJM-89GP Prototype Pollution in merge

All versions of package merge 2.1.1 are vulnerable to Prototype Pollution via recursiveMerge...

Prototype Pollution

Overview tree-kit is a Tree utilities which provides a full-featured extend and object-cloning facility, and various tools to deal with nested object structures. Affected versions of this package are vulnerable to Prototype Pollution via dotPath.set. PoC: const dotPath = require'tree-kit'...

Prototype Pollution

Overview merge-deep is a recursively merges values in a javascript object. Affected versions of this package are vulnerable to Prototype Pollution. Merge-deep actively attempts to prevent prototype pollution by blocking object property merges into proto, however it still allows for prototype...

Prototype Pollution

Overview @lyngs/digger is an Use digger to value, from deep inside of an . Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const digger = require"@lyngs/digger"; console.log'Prototype before dig', .isAdmin; digger, 'proto.isAdmin', true,...