Common Weakness Enumeration

CWE-1321

Allowed

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Abstraction: Variant · Status: Incomplete

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

821 vulnerabilities reference this CWE, most recent first.

GHSA-89QM-HM2X-MXM3

Vulnerability from github – Published: 2023-06-12 06:30 – Updated: 2023-10-09 20:17
VLAI
Summary
progressbar.js vulnerable to Prototype Pollution
Details

All versions of the package progressbar.js prior to 1.1.1 are vulnerable to Prototype Pollution via the function extend() in the file utils.js.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "progressbar.js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-26133"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-12T18:53:32Z",
    "nvd_published_at": "2023-06-12T05:15:09Z",
    "severity": "HIGH"
  },
  "details": "All versions of the package progressbar.js prior to 1.1.1 are vulnerable to Prototype Pollution via the function extend() in the file utils.js.\n\n",
  "id": "GHSA-89qm-hm2x-mxm3",
  "modified": "2023-10-09T20:17:11Z",
  "published": "2023-06-12T06:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26133"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kimmobrunfeldt/progressbar.js/commit/97fe68ef4beccfe84b7cba08ea1fc695e38cc04b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kimmobrunfeldt/progressbar.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js#L18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js#L20"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "progressbar.js vulnerable to Prototype Pollution"
}

GHSA-8F8G-9J73-7P82

Vulnerability from github – Published: 2022-09-16 00:00 – Updated: 2022-09-21 21:07
VLAI
Summary
steal vulnerable to Prototype Pollution via optionName variable
Details

Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "steal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-37264"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-21T21:07:43Z",
    "nvd_published_at": "2022-09-15T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.",
  "id": "GHSA-8f8g-9j73-7p82",
  "modified": "2022-09-21T21:07:43Z",
  "published": "2022-09-16T00:00:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37264"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stealjs/steal/issues/1533"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/stealjs/steal"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L2194"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L647"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "steal vulnerable to Prototype Pollution via optionName variable"
}

GHSA-8G4M-CJM2-96WQ

Vulnerability from github – Published: 2022-03-18 00:01 – Updated: 2022-03-25 16:47
VLAI
Summary
Sandbox escape in notevil and argencoders-notevil
Details

This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. Note: This vulnerability derives from an incomplete fix in SNYK-JS-NOTEVIL-608878. This package has been deprecated.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "notevil"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "argencoders-notevil"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23771"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-18T23:07:57Z",
    "nvd_published_at": "2022-03-17T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object\u0027s prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878). This package has been deprecated.",
  "id": "GHSA-8g4m-cjm2-96wq",
  "modified": "2022-03-25T16:47:42Z",
  "published": "2022-03-18T00:01:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23771"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mmckegg/notevil"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sandbox escape in notevil and argencoders-notevil"
}

GHSA-8G77-54RH-46HX

Vulnerability from github – Published: 2025-03-12 21:31 – Updated: 2025-03-20 19:27
VLAI
Summary
Prototype Pollution Vulnerability in parse-git-config
Details

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "parse-git-config"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-25975"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-16T17:22:50Z",
    "nvd_published_at": "2025-03-12T19:15:40Z",
    "severity": "HIGH"
  },
  "details": "An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function.",
  "id": "GHSA-8g77-54rh-46hx",
  "modified": "2025-03-20T19:27:20Z",
  "published": "2025-03-12T21:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25975"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jonschlinkert/parse-git-config/issues/14"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jonschlinkert/parse-git-config"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Prototype Pollution Vulnerability in parse-git-config"
}

GHSA-8GH8-HQWG-XF34

Vulnerability from github – Published: 2022-12-25 21:30 – Updated: 2024-03-01 14:21
VLAI
Summary
Starcounter-Jack JSON-Patch Prototype Pollution vulnerability
Details

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 can address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-json-patch"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-4279"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-30T16:27:22Z",
    "nvd_published_at": "2022-12-25T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 can address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.",
  "id": "GHSA-8gh8-hqwg-xf34",
  "modified": "2024-03-01T14:21:21Z",
  "published": "2022-12-25T21:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4279"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Starcounter-Jack/JSON-Patch/pull/262"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Starcounter-Jack/JSON-Patch/commit/7ad6af41eabb2d799f698740a91284d762c955c9"
    },
    {
      "type": "WEB",
      "url": "https://blog.effectrenan.com/pwn2win-2021-illusion-web-challenge"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Starcounter-Jack/JSON-Patch"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Starcounter-Jack/JSON-Patch/releases/tag/3.1.1"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.216778"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.216778"
    },
    {
      "type": "WEB",
      "url": "https://www.huntr.dev/bounties/1-npm-fast-json-patch"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Starcounter-Jack JSON-Patch Prototype Pollution vulnerability"
}

GHSA-8GW3-RXH4-V6JX

Vulnerability from github – Published: 2025-11-14 18:31 – Updated: 2025-11-17 18:39
VLAI
Summary
expr-eval vulnerable to Prototype Pollution
Details

npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "expr-eval"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "expr-eval-fork"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-13204"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-17T18:39:19Z",
    "nvd_published_at": "2025-11-14T17:16:01Z",
    "severity": "HIGH"
  },
  "details": "npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.",
  "id": "GHSA-8gw3-rxh4-v6jx",
  "modified": "2025-11-17T18:39:19Z",
  "published": "2025-11-14T18:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13204"
    },
    {
      "type": "WEB",
      "url": "https://github.com/silentmatt/expr-eval/pull/252/files"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jorenbroekema/expr-eval/commit/6c475a118643ae0efe012de283e932fb8b74324b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/silentmatt/expr-eval/commit/6e889e0e75c50ac37d70c35388602025650e0c50"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jorenbroekema/expr-eval"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/silentmatt/expr-eval"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py"
    },
    {
      "type": "WEB",
      "url": "https://www.huntr.dev/bounties/1-npm-expr-eval"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/expr-eval-fork"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "expr-eval vulnerable to Prototype Pollution"
}

GHSA-8GWJ-8HXC-285W

Vulnerability from github – Published: 2021-11-08 17:43 – Updated: 2021-11-08 17:43
VLAI
Summary
Prototype Pollution in json-ptr
Details

This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "json-ptr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23509"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-843"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-04T16:56:49Z",
    "nvd_published_at": "2021-11-03T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "This affects the package `json-ptr` before `3.0.0`. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.",
  "id": "GHSA-8gwj-8hxc-285w",
  "modified": "2021-11-08T17:43:16Z",
  "published": "2021-11-08T17:43:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23509"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flitbit/json-ptr/pull/42"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flitbit/json-ptr/commit/5dc458fbad1c382a2e3ca6d62e66ede3d92849ca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/flitbit/json-ptr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flitbit/json-ptr%23security-vulnerabilities-resolved"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-JSONPTR-1577291"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in json-ptr"
}

GHSA-8HQ9-PHH3-P2WP

Vulnerability from github – Published: 2026-03-17 16:17 – Updated: 2026-03-19 19:01
VLAI
Summary
Elysia Cookie Value Prototype Pollution
Details

Impact

Elysia cookie can be overridden by prototype pollution , eg. __proto__

Sending cookie with the follows name can override cookie value:

__proto__=%7B%22injected%22%3A%22polluted%22%7D

Patches

Patched by 1.4.27

Workarounds

  1. Use t.Cookie validation to enforce validation value
  2. Prevent iterable over cookie if possible
Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "elysia"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-31865"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-17T16:17:41Z",
    "nvd_published_at": "2026-03-18T04:17:19Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nElysia cookie can be overridden by prototype pollution , eg. `__proto__`\n\nSending cookie with the follows name can override cookie value:\n```bash\n__proto__=%7B%22injected%22%3A%22polluted%22%7D\n```\n\n### Patches\nPatched by 1.4.27\n\n### Workarounds\n1. Use t.Cookie validation to enforce validation value\n2. Prevent iterable over cookie if possible",
  "id": "GHSA-8hq9-phh3-p2wp",
  "modified": "2026-03-19T19:01:12Z",
  "published": "2026-03-17T16:17:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/elysiajs/elysia/security/advisories/GHSA-8hq9-phh3-p2wp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31865"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/elysiajs/elysia"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Elysia Cookie Value Prototype Pollution"
}

GHSA-8J49-49JQ-VWCQ

Vulnerability from github – Published: 2020-09-04 15:15 – Updated: 2020-08-31 18:55
VLAI
Summary
Prototype Pollution in getsetdeep
Details

All versions of getsetdeep are vulnerable to prototype pollution. The setDeep() function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "getsetdeep"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:55:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "All versions of `getsetdeep` are vulnerable to prototype pollution. The `setDeep()` function does not restrict the modification of an Object\u0027s prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
  "id": "GHSA-8j49-49jq-vwcq",
  "modified": "2020-08-31T18:55:30Z",
  "published": "2020-09-04T15:15:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1334"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Prototype Pollution in getsetdeep"
}

GHSA-8MMM-9V2Q-X3F9

Vulnerability from github – Published: 2022-10-12 12:00 – Updated: 2024-04-22 23:15
VLAI
Summary
tschaub gh-pages vulnerable to prototype pollution
Details

Prototype pollution vulnerability in tschaub gh-pages via the partial variable in util.js.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "gh-pages"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-37611"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-22T23:15:25Z",
    "nvd_published_at": "2022-10-12T01:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Prototype pollution vulnerability in tschaub gh-pages via the partial variable in util.js.",
  "id": "GHSA-8mmm-9v2q-x3f9",
  "modified": "2024-04-22T23:15:25Z",
  "published": "2022-10-12T12:00:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37611"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tschaub/gh-pages/issues/446"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tschaub/gh-pages/pull/452"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tschaub/gh-pages"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "tschaub gh-pages vulnerable to prototype pollution"
}

Mitigation
Implementation

By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

Mitigation
Architecture and Design

By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Mitigation
Implementation

Strategy: Input Validation

When handling untrusted objects, validating using a schema can be used.

Mitigation
Implementation

By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.

Mitigation
Implementation

Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.