Executive brief
madlib-object-utils is a JavaScript utility library for manipulating object properties, commonly used in Node.js applications. The library contains a prototype pollution vulnerability in its setValue function that allows attackers to inject or modify properties on JavaScript object prototypes, potentially compromising all downstream objects and enabling arbitrary code execution or service disruption across applications using this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) in madlib-object-utils versions before 0.1.7, specifically in the setValue method. Prototype pollution exploits unsafe object property assignment to inject malicious properties into Object.prototype or other core prototypes, affecting all objects created thereafter. The attack requires only network connectivity and no authentication; an attacker can invoke the vulnerable setValue function via application code paths that accept untrusted input. Exploitation allows modification of application behavior, denial of service, or remote code execution depending on downstream usage. The fix was applied in version 0.1.7 with commit 2a8d5be.
Affected products
- madlib-object-utils madlib-object-utils before 0.1.7
Timeline
- 2020-08-14: disclosed
- 2021-05-06: advisory
- 2021-05-06: patched: Fixed in version 0.1.7