Executive brief
utils-extend is a JavaScript utility library for merging object properties. The library contains a flaw that allows an attacker to inject properties into an object's prototype, potentially affecting all objects in an application. This could lead to unexpected behavior, data manipulation, or authentication bypasses depending on how the application uses object properties.
Technical details
The vulnerability is a prototype pollution flaw in the extend function of utils-extend. The function does not properly validate or restrict modifications to an object's prototype chain, allowing an attacker to inject arbitrary properties via the extend function by crafting specially-formed input objects. An attacker with the ability to control the data passed to extend (typically via untrusted user input or network data) can pollute the prototype of Object or other constructors, causing injected properties to appear on all objects created from that point forward. No patch is currently available; users are advised to migrate to alternative packages or implement input validation.
Affected products
- npm utils-extend all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: other: GitHub reviewed