Prototype Pollution

js-data is vulnerable to pollution prototype. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the deepMixIn function...

CVE-2020-28442

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...

CVE-2020-28442

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...

CVE-2020-28442

CVE-2020-28442 (js-data) : Multiple connected sources confirm Prototype Pollution in js-data via the deepFillIn function and, in some advisories, the set function. Affected are all versions prior to the fix, with an incomplete remediation described; the OSV/GHSA entries specify vulnerability acro...

js-data-dao (1.0.0) potentially affected by CVE-2020-28442 via js-data (3.0.0-rc.5)

js-data NPM version 3.0.0-rc.5 is affected by a known vulnerability. The following packages have a transitive dependency on js-data and may be impacted: - js-data-dao 1.0.0 Source cves: CVE-2020-28442 Source advisory: SNYK:JS-JSDATA-1023655...

Prototype Pollution

Overview js-data is a Robust, framework-agnostic in-memory data store. Affected versions of this package are vulnerable to Prototype Pollution via the deepMixIn and deepFillIn functions. PoC const utils = require"js-data"; const obj = ; const source = JSON.parse'"proto":"polluted":"yes"';...