Prototype Pollution

2021-09-1403:53:02

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

prototype pollution

software

injection

set()

zipobject()

EPSS

0.004

Percentile

72.4%

JSON

@viking04/merge is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as __proto__, constructor and prototype via the set() and zipObject() function.