GHSA-23wx-cgxq-vpwx

Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-23wx-cgxq-vpwx/GHSA-23wx-cgxq-vpwx.json

Aliases

• CVE-2022-25645

Published

2022-05-03T00:00:45Z

Modified

2023-04-11T01:32:17.520203Z

Details

All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or prototype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-25645
• https://github.com/lukeed/dset
• https://github.com/lukeed/dset/blob/master/src/merge.js%23L9
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2431974
• https://snyk.io/vuln/SNYK-JS-DSET-2330881