GHSA-9gxr-rhx6-4jgv

Source

https://github.com/advisories/GHSA-9gxr-rhx6-4jgv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-9gxr-rhx6-4jgv/GHSA-9gxr-rhx6-4jgv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9gxr-rhx6-4jgv

Published

2020-09-04T15:18:57Z

Modified

2020-08-31T18:55:36Z

Summary

Sandbox Breakout / Prototype Pollution in notevil

Details

Versions of notevil prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype.

Evaluating the payload try{a[b];}catch(e){e.constructor.constructor('return __proto__.arguments.callee.__proto__.polluted=true')()} add the polluted property to Function.

Recommendation

Upgrade to version 1.3.3 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-1321"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:55:36Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

https://www.npmjs.com/advisories/1338

Affected packages

npm / notevil

Package

Name: notevil; View open source insights on deps.dev
Purl: pkg:npm/notevil

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.3.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-9gxr-rhx6-4jgv/GHSA-9gxr-rhx6-4jgv.json"