https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:17:00 +0000 https://vulnerability.circl.lu/vuln/ghsa-44fc-8fm5-q62h <p><strong>Affected:</strong> npm: convict</p> <p>### Summary A prototype pollution vulnerability exists in the latest version of the convict npm package (6.2.4). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using `String.prototype`.</p> <p>### Details The vulnerability resides in line 564 of https://github.com/mozilla/node-convict/blob/master/packages/convict/src/main.js where `startsWith()` function is used to check whether user provided input contain forbidden strings.</p> <p>### PoC #### Steps to reproduce 1. Install latest version of convict using `npm install` or cloning from git 2. Run the following code snippet:</p> <p>```javascript String.prototype.startsWith = () =&gt; false; const convict = require(&#39;convict&#39;); let obj = {}; const config = convict(obj); console.log({}.polluted); config.set(&#39;constructor.prototype.polluted&#39;, &#39;yes&#39;); console.log({}.polluted); // prints yes -&gt; the patch is bypassed and prototype pollution occurred ```</p> <p>#### Expected behavior Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console: ``` undefined undefined OR throw an Error ```</p> <p>#### Actual behavior `Object.prototype` is polluted This is printed on the console: ``` undefined yes ```</p> <p>### Impact This is a prototype pollution vulnerability, which can have severe security implications depending on how convict is used by downstream applica…</p> <p><strong>Affected:</strong> npm: convict</p> <p>### Summary A prototype pollution vulnerability exists in the latest version of the convict npm package (6.2.4). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using `String.prototype`.</p> <p>### Details The vulnerability resides in line 564 of https://github.com/mozilla/node-convict/blob/master/packages/convict/src/main.js where `startsWith()` function is used to check whether user provided input contain forbidden strings.</p> <p>### PoC #### Steps to reproduce 1. Install latest version of convict using `npm install` or cloning from git 2. Run the following code snippet:</p> <p>```javascript String.prototype.startsWith = () =&gt; false; const convict = require(&#39;convict&#39;); let obj = {}; const config = convict(obj); console.log({}.polluted); config.set(&#39;constructor.prototype.polluted&#39;, &#39;yes&#39;); console.log({}.polluted); // prints yes -&gt; the patch is bypassed and prototype pollution occurred ```</p> <p>#### Expected behavior Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console: ``` undefined undefined OR throw an Error ```</p> <p>#### Actual behavior `Object.prototype` is polluted This is printed on the console: ``` undefined yes ```</p> <p>### Impact This is a prototype pollution vulnerability, which can have severe security implications depending on how convict is used by downstream applica…</p> https://vulnerability.circl.lu/vuln/ghsa-44fc-8fm5-q62h