Headline

GHSA-g954-5hwp-pp24: Prototype Pollution in protobufjs

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.

This vulnerability can occur in multiple ways:

by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions
by parsing/loading .proto files

2 years ago

ghsa

Open in Source

#vulnerability #nodejs #js #git

GitHub Advisory Database
GitHub Reviewed
CVE-2022-25878

Prototype Pollution in protobufjs

High severity GitHub Reviewed Published May 28, 2022 • Updated Jun 2, 2022

We are still processing this advisory. You may have affected repositories that are not yet on this list. Check back soon for more.

Package

npm protobufjs (npm )

Affected versions

< 6.11.3

Description

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files

2 years ago

CVE

Open in Source

#vulnerability #js #git