EUVD-2021-2051

Malware in sbrugna...

@breautek/storm (>=2.0.0 <=3.0.0-rc.0), create-react-solution (>=1.2.0 <=4.4.1) +2 more potentially affected by CVE-2021-23421 via merge-change (>=1.5.3 <=1.8.1)

merge-change NPM version =1.5.3, =2.0.0, =1.2.0, =1.5.0, =4.0.0, =4.4.1 Source cves: CVE-2021-23421 Source advisory: OSV:GHSA-F9CV-665R-275H...

Prototype Pollution in merge-change

All current versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

GHSA-F9CV-665R-275H Prototype Pollution in merge-change

All current versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

CVE-2021-23421

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

Code injection

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

CVE-2021-23421

CVE-2021-23421 affects merge-change: all versions are vulnerable to Prototype Pollution via the utils.set function. The root cause is an unsafe recursive merge that can propagate pollution to Object.prototype when certain properties (e.g., proto ) are set or when the path-based API is abused. The...

CVE-2021-23421 Prototype Pollution

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

CVE-2021-23421

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

merge-change 软件包安全漏洞

merge-change is an open source simple library for deep merging of objects and other types, also for patching and immutable new. The merge-change package has a security vulnerability that makes the package susceptible to prototype contamination via the utils.set function...

Prototype Pollution

Overview merge-change is a Deep merge of objects and other types, also for patches and immutable updates. Affected versions of this package are vulnerable to Prototype Pollution via the utils.set function. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution...