Prototype Pollution

2023-01-0508:51:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

prototype pollution

unflatten function

index.js

object attributes

security vulnerability

0.006 Low

EPSS

Percentile

78.7%

JSON

flat is vulnerable to prototype pollution. The vulnerability exists in the unflatten function of index.js, due to the improper checks for the key1 variable which allows an attacker to modify object prototype attributes.

CPENameOperatorVersion
flatle5.0.0
flatle4.1.1
flatle5.0.0
flatle4.1.1

Name	Operator	Version
flat	le	5.0.0
flat	le	4.1.1
flat	le	5.0.0
flat	le	4.1.1

References

github.com/hughsk/flat/commit/20ef0ef55dfa028caddaedbcb33efbdb04d18e13

github.com/hughsk/flat/issues/105

github.com/hughsk/flat/pull/106

github.com/hughsk/flat/releases/tag/5.0.1

vuldb.com/?ctiid.216777

vuldb.com/?id.216777

0.006 Low

EPSS

Percentile

78.7%

JSON

Related for VERACODE:38776