Executive brief
dot-object is a JavaScript utility library used to manipulate nested object properties. A prototype pollution vulnerability in versions before 2.1.3 allows attackers to modify or inject properties into Object.prototype, potentially affecting all objects in an application and leading to unexpected behavior, data corruption, or privilege escalation depending on how the application uses these objects.
Technical details
This is a prototype pollution vulnerability (CWE-74) in the set() function of dot-object. The vulnerability occurs because the function does not properly validate property names and can be tricked into modifying protected properties like __proto__, prototype, and constructor. An attacker with the ability to control input passed to the set() function (typically requires authenticated access or network-reachable input) can inject or overwrite properties on Object.prototype, affecting all objects in the JavaScript runtime. The fix, introduced in version 2.1.3, implements a blacklist to guard against these dangerous property names.
Affected products
- npm dot-object before 2.1.3
Timeline
- 2020-02-18: disclosed
- 2020-02-16: patched: Fix committed to repository