Executive brief
predefine is a JavaScript library used to merge and manipulate object properties. A prototype pollution vulnerability allows attackers to inject malicious properties into all objects in an application, potentially leading to denial of service or remote code execution without requiring authentication or user interaction.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1333) in the merge function of predefine versions 0.0.0 through 0.1.2. The vulnerable code at index.js line 284 fails to sanitize object keys during recursive merge operations, allowing an attacker to pollute the Object prototype by crafting specially malformed input with keys like "__proto__" or "constructor". The vulnerability is network-accessible with no authentication or user interaction required (CVSS AV:N/AC:L/PR:N/UI:N). An attacker can modify the behavior of all objects in the application runtime, leading to denial of service or potentially remote code execution depending on application logic. The vulnerability was fixed in version 0.1.3.
Affected products
- npm predefine 0.0.0 through 0.1.2
Timeline
- 2020-12-29: disclosed: NVD published
- 2021-01: patched: Fixed in version 0.1.3
- 2021-10-12: advisory: GitHub advisory GHSA-mx3x-ghqm-r43h published