GHSA-fp82-2h99-3fpp

Source

https://github.com/advisories/GHSA-fp82-2h99-3fpp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-fp82-2h99-3fpp/GHSA-fp82-2h99-3fpp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fp82-2h99-3fpp

Aliases

CVE-2018-3753

Published

2018-09-18T13:47:24Z

Modified

2023-11-08T04:00:19Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Prototype Pollution in async merge-object

Details

The utilities function in all versions of the merge-object node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Database specific

{
    "cwe_ids": [
        "CWE-1321",
        "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:35:00Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
}

References

Affected packages

npm / merge-object

Package

Name: merge-object; View open source insights on deps.dev
Purl: pkg:npm/merge-object

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-fp82-2h99-3fpp/GHSA-fp82-2h99-3fpp.json"