PT-2022-9026

Name of the Vulnerable Software and Affected Versions hughsk flat versions up to 5.0.0 Description A critical vulnerability was found in hughsk flat, affecting the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes,...

flat 安全漏洞

flat is a library from Hugh Kennedy's personal developer. It is used to take a nested Javascript object and flatten it, or to unflatten the object using the separator key. A security vulnerability exists in versions prior to flat 5.0.1, which stems from a problem with the unflatten function in th...

PT-2022-34586 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.11 Description: The issue is related to an off-by-one error in the unflatten dt nodes function. This error was introduced in version v4.7 and is fixed in version v5.19.11. The actual impact and attack...

PT-2022-34654 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.145 Description: The issue is related to an off-by-one error in the unflatten dt nodes function. This error was introduced in version v4.7 and fixed in version v5.10.145. The actual impact and attack...

GHSA-W8F3-PVX4-4C3H Prototype Pollution in arr-flatten-unflatten

All versions of package arr-flatten-unflatten up to and including version 1.1.4 are vulnerable to Prototype Pollution via the constructor...

Prototype Pollution in arr-flatten-unflatten

All versions of package arr-flatten-unflatten up to and including version 1.1.4 are vulnerable to Prototype Pollution via the constructor...

Prototype Pollution

safe-flat is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the unflatten function...

Prototype Pollution in quernest/arr-flatten-unflatten

Description arr-flatten-unflatten is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var arrFlattenUnflatten = require"arr-flatten-unflatten" console.log"Before : " + .polluted; arrFlattenUnflatten.unflatten'protopolluted': 'Yes! Its Polluted';...

Prototype Pollution in bonnevoyager/nested-objects-util

Description nested-objects-util is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var unflatten = require"nested-objects-util" console.log"Before : " + .polluted; unflatten"proto.polluted": "Yes! Its Polluted" console.log"After : " + .polluted; 2...

Prototype Pollution in ionicabizau/obj-unflatten

Description obj-unflatten convert flatten objects in nested ones. This package is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: javascript // poc.js const unflatten = require'obj-unflatten' console.log'Before: ' + .polluted unflatten'proto.polluted':...

GHSA-6FH5-8WQ8-W3WR Prototype Pollution in unflatten

All versions of unflatten are vulnerable to prototype pollution. The function unflatten does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...

Prototype Pollution in unflatten

All versions of unflatten are vulnerable to prototype pollution. The function unflatten does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...

Prototype Pollution in flat-wrap

All versions of flat-wrap are vulnerable to prototype pollution. The function unflatten does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...

GHSA-G7H8-P22M-2RVX Prototype Pollution in flat-wrap

All versions of flat-wrap are vulnerable to prototype pollution. The function unflatten does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...

Prototype Pollution

arr-flatten-unflatten is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CVE-2020-7713

All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor...

CVE-2020-7713

CVE-2020-7713 affects the npm package arr-flatten-unflatten . All versions up to and including 1.1.4 are vulnerable to prototype pollution via the constructor . Public advisories (GHSA, OSV, Snyk, Veracode) confirm the issue and provide a PoC demonstrating pollution of Object.prototype. There is ...

CVE-2020-7713 Prototype Pollution

All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor...

PT-2020-19735 · Npm · Arr-Flatten-Unflatten

Name of the Vulnerable Software and Affected Versions: arr-flatten-unflatten versions up to and including 1.1.4 Description: The issue concerns Prototype Pollution via the constructor. This means that an attacker could potentially manipulate the prototype of an object, leading to unintended...

Prototype Pollution

Overview arr-flatten-unflatten is a non-recursive method of flattening an array or arrays and unflattening the result Affected versions of this package are vulnerable to Prototype Pollution via the constructor. POC: const unflatten = require'arr-flatten-unflatten'; unflatten'proto.polluted':true;...