Executive brief
safe-object2 is a JavaScript library for secure object manipulation. A prototype pollution vulnerability in its setter function allows attackers to inject malicious properties into the base Object prototype, potentially leading to denial of service, code execution, or unauthorized privilege escalation in applications that use this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the safe-object2 library's setter function. By calling obj.setter() with a path containing '__proto__', an attacker can inject properties into the Object.prototype. This is a network-reachable vulnerability with no authentication or user interaction required if the vulnerable library is used by server-side code processing untrusted input. An attacker can achieve remote code execution, denial of service via object corruption, or privilege escalation by polluting security-related properties. There is no patched version available for safe-object2; users must migrate to an alternative library.
Affected products
- safe-object2 all versions up to 1.0.3
Timeline
- 2020-08-17: disclosed
- 2020-09-01: advisory: NVD published
- 2021-05-06: other: GitHub advisory GHSA-jpq3-xf27-5jf2 published