Executive brief
nis-utils is a JavaScript utility library used to manipulate objects and data structures. A prototype pollution vulnerability in the setValue function allows attackers to inject malicious properties into the base Object prototype, potentially causing application crashes, security bypasses, or code execution depending on how the application uses affected properties.
Technical details
The vulnerability is a prototype pollution flaw in the setValue function (CWE-1321, CWE-915) affecting nis-utils versions up to 0.6.10. It exploits unsafe property definition by path, allowing an attacker to set properties on __proto__ (e.g., "__proto__.polluted") to inject values into Object.prototype. An attacker with network access can craft malicious input that pollutes the prototype chain without authentication. Exploitation can lead to denial of service by corrupting inherited functions, property injection for privilege escalation, or remote code execution if the application evaluates polluted properties. No patched version is available; the package remains vulnerable.
Affected products
- nis-utils nis-utils 0.6.10 and earlier
Timeline
- 2020-08-17: disclosed
- 2021-05-06: advisory