Executive brief
arr-flatten-unflatten is a JavaScript utility library used to flatten and unflatten nested data structures. A prototype pollution vulnerability in all versions up to 1.1.4 allows attackers to inject malicious properties into JavaScript object prototypes, potentially corrupting application behavior or enabling further exploits. This could lead to unauthorized data modification or application crashes in any service that uses this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the arr-flatten-unflatten library's constructor that allows attackers to inject properties via the __proto__, constructor, or prototype attributes. The attack is network-reachable and requires no authentication or user interaction—any application using a vulnerable version processes untrusted input through the constructor. An attacker can pollute the Object.prototype, causing all JavaScript objects in the application to inherit malicious properties, potentially leading to logic bypass, denial of service, or remote code execution depending on how the application uses the polluted properties. A fix was merged in January 2021 (PR #8); users should upgrade to version 1.1.5 or later.
Affected products
- npm arr-flatten-unflatten up to and including 1.1.4
Timeline
- 2020-09-01: disclosed: Published on NVD
- 2021-05-06: advisory: GHSA advisory published
- 2021-01-25: patched: Fix merged in PR #8