Prototype Pollution

Overview @fluentui/styles is a set of styling utilities for CSS-in-JS. Affected versions of this package are vulnerable to Prototype Pollution. The deepmerge function available within the styles package of FluentUI allows one object to merge with another recursively. Given a value such as proto,...

Prototype Pollution in @apollo/gateway

Versions of @apollo/gateway prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objects in the...

PT-2019-20019

Name of the Vulnerable Software and Affected Versions @apollo/gateway versions prior to 0.6.2 Description The issue allows attackers to alter the Object prototype through queries with GraphQL aliases, potentially leading to Denial of Service or Remote Code Execution when chained with other...

Prototype Pollution

Overview Versions of @apollo/gateway prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objec...