Executive brief
record-like-deep-assign is a JavaScript library that recursively merges objects. A prototype pollution vulnerability allows attackers to inject malicious properties into the Object prototype, potentially compromising all objects in an application and leading to unauthorized data access or code execution.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) in the record-like-deep-assign library's main functionality. When processing untrusted JSON or object data, the library fails to sanitize the __proto__ property, allowing attackers to pollute the Object prototype. The vulnerability is exploitable via network-reachable input (untrusted JSON) with no authentication required. A successful attack enables modification of the prototype chain, affecting all objects in the running application. All versions up to and including 1.0.1 are vulnerable; a fix status is not documented in the advisory.
Affected products
- npm record-like-deep-assign 0 to 1.0.1
Timeline
- 2021-07-02: disclosed: CVE published by NVD
- 2021-12-10: advisory: GitHub advisory GHSA-7qm6-9v49-38m9 published