GHSA-c3px-v9c7-m734

Suggest an improvement
Source
https://github.com/advisories/GHSA-c3px-v9c7-m734
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-c3px-v9c7-m734/GHSA-c3px-v9c7-m734.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c3px-v9c7-m734
Published
2020-09-03T19:04:39Z
Modified
2020-08-31T18:47:02Z
Summary
Prototype Pollution in mithril
Details

Affected versions of mithrilare vulnerable to prototype pollution. The function parseQueryString may allow a malicious user to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. A payload such as __proto__%5BtoString%5D=123 in the query string would change the toString() function to 123.

Recommendation

If you are using mithril 2.x, upgrade to version 2.0.2 or later. If you are using mithril 1.x, upgrade to version 1.1.7 or later.

Database specific 
{
    "cwe_ids": [
        "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:47:02Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

npm / mithril

Package

Name
mithril
View open source insights on deps.dev
Purl
pkg:npm/mithril

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.1.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-c3px-v9c7-m734/GHSA-c3px-v9c7-m734.json"

npm / mithril

Package

Name
mithril
View open source insights on deps.dev
Purl
pkg:npm/mithril

Affected ranges

Type
SEMVER
Events
Introduced
2.0.0
Fixed
2.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-c3px-v9c7-m734/GHSA-c3px-v9c7-m734.json"