Executive brief
simpl-schema is a popular data validation library used in JavaScript applications to enforce data structure rules. A prototype pollution vulnerability allows attackers to inject malicious code through crafted schema input, potentially leading to remote code execution within the application. Applications using vulnerable versions of this library are at risk of complete compromise.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the simpl-schema library before version 1.10.2, where insufficient validation of object merging operations allows an attacker to pollute the JavaScript object prototype. The vulnerability is triggered when attacker-controlled input is processed into a schema definition, enabling modification of core object properties. The attack is network-reachable and requires no authentication or user interaction. A successful exploit can result in remote code execution within the scope of the affected application. The fix is available in version 1.10.2 and later.
Affected products
- longshotlabs simpl-schema < 1.10.2
Timeline
- 2020-10-07: disclosed
- 2021-05-10: advisory
- 2021: patched: version 1.10.2