js-data security vulnerabilities

js-data is a framework-agnostic, datastore-agnostic ORM for Node.js and browsers. A security vulnerability exists in js-data that stems from packages being susceptible to prototype contamination via the deepFillIn and set functions...

Prototype Pollution

Overview js-data is a Robust, framework-agnostic in-memory data store. Affected versions of this package are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442. PoC 1 var jsdata = require'js-data'; var obj = ; var payload =...

@blerpapp/js-data-cloud-datastore (>=1.0.0-rc.2, <=1.0.0-rc.3), @citygro/vdata (>=5.0.0, <=8.10.0) +90 more potentially affected by CVE-2020-28442 +1 more via js-data (>=0.4.2, <=4.0.0-beta.4)

js-data NPM version =0.4.2, =1.0.0-rc.2, =5.0.0, =0.3.27, =0.3.0, =1.0.2, =1.0.0, =0.1.0, =0.1.2, =2.1.30, =1.2.15-alpha, =0.2.5, =1.0.0, =1.3.1 - api-fusion 0.1.2 and more Source cves: CVE-2020-28442, CVE-2021-23574 Source advisory: SNYK:JS-JSDATA-1584361...

Prototype Pollution

js-data is vulnerable to pollution prototype. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the deepMixIn function...

Prototype Pollution in js-data/js-data

Description js-data is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js const js = require"js-data"; const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " + .polluted; js.utils.deepMixInobj, payload;...

Prototype Pollution

js-data is vulnerable to pollution prototype. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the deepMixIn function...

CVE-2020-28442

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...

CVE-2020-28442

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...

CVE-2020-28442

CVE-2020-28442 (js-data) : Multiple connected sources confirm Prototype Pollution in js-data via the deepFillIn function and, in some advisories, the set function. Affected are all versions prior to the fix, with an incomplete remediation described; the OSV/GHSA entries specify vulnerability acro...

CVE-2020-28442

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...

@cloudnexa/vnoc-bedrock (>=0.3.27, <=1.0.2), @oguennec/remotedev-server (0.8.4) +46 more potentially affected by CVE-2020-28442 via js-data (>=0.4.2, <=3.0.0-rc.5)

js-data NPM version =0.4.2, =0.3.27, =1.0.2, =1.0.0, =0.2.5, =1.0.0, =2.0.1, =1.1.1, =1.0.0, =0.0.2, =0.4.2, =0.4.2, =2.2.4 and more Source cves: CVE-2020-28442 Source advisory: MEND:CVE-2020-28442...

CVE-2020-28442: Undefined Security Weakness

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...

PT-2020-17011

Name of the Vulnerable Software and Affected Versions js-data versions prior to 3.0.10 Description The issue concerns Prototype Pollution via the deepFillIn function. This allows for potential manipulation of object properties. No information is provided about the estimated number of affected...

Prototype Pollution

Overview js-data is a Robust, framework-agnostic in-memory data store. Affected versions of this package are vulnerable to Prototype Pollution via the deepMixIn and deepFillIn functions. PoC const utils = require"js-data"; const obj = ; const source = JSON.parse'"proto":"polluted":"yes"';...

js-data-dao (1.0.0) potentially affected by CVE-2020-28442 via js-data (3.0.0-rc.5)

js-data NPM version 3.0.0-rc.5 is affected by a known vulnerability. The following packages have a transitive dependency on js-data and may be impacted: - js-data-dao 1.0.0 Source cves: CVE-2020-28442 Source advisory: SNYK:JS-JSDATA-1023655...