Executive brief
controlled-merge is a widely-used npm library for safely merging JavaScript objects. A prototype pollution flaw in versions 1.0.0 through 1.2.0 allows attackers to inject malicious code into JavaScript prototypes through untrusted input. This can crash applications, disrupt service availability, and potentially allow arbitrary code execution on systems using vulnerable versions.
Technical details
The controlled-merge npm package contains a prototype pollution vulnerability (CWE-1321) in its core merge function. The vulnerability exists because the library does not properly validate or sanitize object property names, allowing attackers to pollute the Object prototype with arbitrary attributes via specially crafted input objects. The flaw is reachable over the network without authentication or user interaction. An attacker can exploit this to cause denial of service by triggering application crashes, and in certain configurations may achieve remote code execution. The vulnerability was fixed in version 1.3.0 with input validation and sanitization checks added to prevent prototype attribute injection (commit 5a4b2e9).
Affected products
- npm controlled-merge 1.0.0 through 1.2.0
Timeline
- 2020-11-15: disclosed
- 2021-05-18: advisory: GitHub Security Advisory GHSA-5pg7-v24c-9rp9 published
- 2021: patched: Fixed in version 1.3.0