Executive brief
asciitable.js is a JavaScript library used to generate ASCII tables from data arrays. The library contains a prototype pollution vulnerability that allows attackers to inject malicious properties into JavaScript object prototypes, potentially leading to remote code execution or denial of service attacks depending on how the application uses the polluted objects.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the main function of asciitable.js versions prior to 1.0.3. The library performs unsafe recursive merges of objects without sanitizing properties like __proto__, constructor, or prototype. An attacker can craft malicious JSON input containing __proto__ properties that, when processed by the library, pollute the Object.prototype and inject arbitrary properties into all JavaScript objects in the application. Attack requires only network access and no authentication; the attacker simply passes specially crafted input to the library's main function. This can result in denial of service (by breaking implicit function calls like toString/valueOf), property injection (bypassing security checks), or remote code execution (if the application evaluates polluted properties). The vulnerability was fixed in version 1.0.3 via a pull request that sanitizes recursive merge operations.
Affected products
- victornpb asciitable.js <1.0.3
Timeline
- 2020-11-12: disclosed
- 2020-12-18: patched: Fix merged in commit 8db8fc5
- 2021-01-04: advisory: NVD publication
- 2021-04-13: advisory: GHSA publication