WS-2020-0433

In extend-merge in versions 1.0.0 to 1.0.5 is vulnerable to Prototype pollution...

chaos-database (>=16.0.0, <=17.0.1), chaos-database-mysql (>=12.0.0, <=13.0.0) +4 more potentially affected by unknown CVE via extend-merge (1.0.5)

extend-merge NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on extend-merge and may be impacted: - chaos-database =16.0.0, =12.0.0, =12.0.0, =12.0.0, =4.0.0, =16.0.2, =17.0.1 Source cves: unknown CVE Source advisory: MEND:WS-2020-0433...

Prototype Pollution

extend-merge is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype through the merge function...

Node.js third-party modules: [extend-merge] Prototype pollution

I would like to report a prototype pollution vulnerability in extend-merge module. It allows an attacker to inject properties on Object.prototype. Module module name: extend-merge version: 1.0.5 npm page: https://www.npmjs.com/package/extend-merge Module Description Shallow extend and deep merge...