Executive brief
The merge-recursive library is a utility used to recursively merge JavaScript objects, commonly used in web applications and build tools. An attacker can exploit a prototype pollution vulnerability by submitting malicious JSON input that modifies the Object prototype, allowing unauthorized modification of properties across the entire application and potentially leading to code execution or data compromise.
Technical details
The vulnerability is a prototype pollution flaw (CWE-20) in all versions of merge-recursive. When the library merges user-controlled input containing the __proto__ key, it unsafely modifies the Object prototype chain, allowing attackers to add or overwrite properties on all JavaScript objects in the application. The attack is network-reachable and requires no authentication or user interaction—an attacker simply sends malicious JSON to any endpoint using merge-recursive. This can lead to privilege escalation, denial of service, or remote code execution depending on how the application uses merged properties. No patch is currently available; applications must remove the dependency or implement custom input validation.
Affected products
- npm merge-recursive 0.0.3 and earlier
Timeline
- 2018-09-18: disclosed