Executive brief
decal is a JavaScript utility library used for object merging and inheritance. A prototype pollution vulnerability in the extend function allows attackers to modify JavaScript object prototypes, potentially corrupting application behavior or enabling code execution across all objects in the application.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the extend function of the decal library, affecting all versions up to and including 2.1.3. The vulnerable function performs deep object merging without properly sanitizing property names, allowing attackers to inject malicious properties into Object.prototype or other built-in prototypes. An attacker can craft malicious JSON or object payloads that, when merged via extend(), pollute the prototype chain. This can lead to unauthorized property injection affecting all objects in the application, enabling logic bypasses, denial of service, or in some contexts, arbitrary code execution. No patch is currently available.
Affected products
- npm decal 0 through 2.1.3
Timeline
- 2021-04-13: disclosed: Advisory published in GitHub Security Advisory Database