Prototype Pollution

Overview org.webjars.npm:parse-git-config is a Parse .git/config into a JavaScript object. sync or async. Affected versions of this package are vulnerable to Prototype Pollution via the expandKeys function. An attacker can obtain sensitive information by exploiting the improper handling of key...

Prototype Pollution in patrickleet/expand-keys

Description expand-keys is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var expandKeys = require"expand-keys" console.log"Before : " + .polluted; expandKeys"proto.polluted": "Yes! Its Polluted" console.log"After : " + .polluted; 2. Execute the...