Executive brief
y18n is an npm library used for internationalization (translation) in Node.js applications. A prototype pollution vulnerability allows attackers to inject malicious properties into the base JavaScript Object prototype, potentially corrupting the behavior of any application using this library. This can lead to application crashes, authentication bypass, or other unpredictable behavior depending on how the polluted properties are processed.
Technical details
The vulnerability is a prototype pollution flaw in y18n's locale handling, specifically in the setLocale() and updateLocale() functions. By setting the locale name to '__proto__' and then calling updateLocale() with arbitrary properties, an attacker can pollute the Object prototype of the JavaScript runtime. The vulnerability requires no authentication and is reachable over the network in applications that expose y18n's locale functions to untrusted input. An attacker can modify inherited properties that affect the application's logic, such as authentication tokens, configuration settings, or operational flags. Patches are available in versions 3.2.2, 4.0.1, and 5.0.5 or later.
Affected products
- yargs y18n before 3.2.2, 4.0.0, 5.0.0 to 5.0.4
Timeline
- 2020-08-06: disclosed: Issue opened on GitHub
- 2020-11-17: advisory: CVE-2020-7774 published on NVD
- 2021-03-12: patched: GitHub Security Advisory published