Prototype Pollution

2023-05-0201:53:45

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vconsole vulnerability

prototype pollution

setoption function

0.002 Low

EPSS

Percentile

54.1%

JSON

vconsole is vulnerable to Prototype Pollution. An attacker can inject properties into existing prototypes via the setOption function of core.ts and modify the __proto__ attribute in the keyOrObj parameter.

CPENameOperatorVersion
vconsolele3.15.0
vconsolele3.3.0
vconsolele3.15.0
vconsolele3.3.0

Name	Operator	Version
vconsole	le	3.15.0
vconsole	le	3.3.0
vconsole	le	3.15.0
vconsole	le	3.3.0

References

cwe.mitre.org/data/definitions/1321.html

github.com/advisories/GHSA-f737-3fh6-jf6w

github.com/Tencent/vConsole/blob/346ae6404c0881a9e18c904a63424df356da801e/src/core/core.ts#L519-L542

github.com/Tencent/vConsole/issues/616

0.002 Low

EPSS

Percentile

54.1%

JSON

Related for VERACODE:40373