Executive brief
@strikeentco/set is a JavaScript utility library for object manipulation. A prototype pollution vulnerability allows attackers to inject malicious properties into JavaScript objects, potentially causing service disruptions or remote code execution if the application passes untrusted data through the library.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the @strikeentco/set library version 1.0.0 that allows an attacker to inject properties into the JavaScript Object prototype. The vulnerability occurs when user-controlled input is passed to the library's set function without proper validation. Exploitation requires network access to an application using the vulnerable library; no authentication is necessary. An attacker can cause denial of service through resource exhaustion or potentially achieve remote code execution depending on how the application processes the polluted objects. The vulnerability was patched in version 1.0.1.
Affected products
- Strike Entertainment @strikeentco/set 1.0.0
Timeline
- 2020-11-10: disclosed
- 2022-05-24: patched: Fixed in version 1.0.1
- 2022-05-24: advisory