Executive brief
GSAP is a popular JavaScript animation library used in web applications to create smooth visual effects. A prototype pollution vulnerability in versions before 3.6.0 allows attackers to modify JavaScript object prototypes, potentially causing application denial of service or unexpected behavior in dependent code.
Technical details
The vulnerability is a prototype pollution flaw in GSAP's core code (gsap-core.js), classified under CWE-400. It affects all versions before 3.6.0. The vulnerability can be exploited over the network without authentication or user interaction required. An attacker can inject properties into the JavaScript Object prototype, causing unintended side effects across the application. The issue was fixed in version 3.6.0, and patches are available from the upstream maintainers.
Affected products
- GreenSock GSAP before 3.6.0
Timeline
- 2021-01-20: disclosed
- 2021-01-20: patched: Fixed in version 3.6.0