Prototype Pollution

2021-02-0906:39:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

dynamoose

vulnerability

prototype pollution

object set

attacker

inject properties

existing construct

modify attributes

__proto__

constructor

prototype

software

EPSS

0.004

Percentile

74.8%

JSON

dynamoose is vulnerable to prototype pollution. The vulnerability exists through lib/utils/object/set.ts where an attacker is able to inject properties into existing construct prototypes and modify attributes such as __proto__, constructor and prototype.