Headline

CVE-2022-25878: fix: do not let setProperty change the prototype by alexander-fenster · Pull Request #1731 · protobufjs/protobuf.js

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.

This vulnerability can occur in multiple ways:

by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions
by parsing/loading .proto files

2 years ago

CVE

Open in Source

#vulnerability #js #git

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: do not let setProperty change the prototype #1731

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files

2 years ago

ghsa

Open in Source

#vulnerability #nodejs #js #git