Executive brief
component-flatten is a JavaScript library used to flatten dependency trees for component management. A prototype pollution vulnerability allows attackers to manipulate the Object prototype, potentially modifying properties across the entire application, which could lead to unexpected behavior or application compromise.
Technical details
The vulnerability is a prototype pollution flaw (CWE-74) in the flatten function that processes component dependency trees. An attacker can inject a __proto__ payload into the tree object to add or modify properties on Object.prototype. The attack is network-reachable and requires the ability to influence the input tree object passed to the flatten function. Successful exploitation allows modification of core JavaScript object properties, which can lead to logic bypasses or data corruption across an application using this library. All versions through 1.0.1 are affected.
Affected products
- component-flatten component-flatten all versions up to and including 1.0.1
Timeline
- 2022-05-24: disclosed
- 2020-02-18: other: NVD published