Executive brief
decal is a JavaScript utility library for object manipulation. The set function is vulnerable to prototype pollution, a technique that allows attackers to modify object prototypes and affect all objects in the application, potentially leading to unexpected behavior, data corruption, or denial of service.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the set function of the decal library affecting all versions up to 2.1.3. Prototype pollution occurs when attacker-controlled input is used to set properties on objects without proper validation, allowing manipulation of the Object prototype. An unauthenticated network attacker can exploit this by providing malicious input to the set function. Successful exploitation can result in modification of application-wide object behavior, causing information disclosure, integrity violations, or denial of service. No patch information is currently available in the advisory.
Affected products
- decal decal all versions up to 2.1.3
Timeline
- 2021-04-13: disclosed
- 2021-02-04: advisory: NVD published