Executive brief
open-graph is a Node.js library for parsing Open Graph metadata tags from web pages. A prototype pollution vulnerability allows an attacker to inject malicious properties into the JavaScript object prototype through crafted input, potentially enabling code injection or property tampering that affects all JavaScript objects in the application.
Technical details
The vulnerability is a prototype pollution flaw in the parse function of the open-graph library (versions before 0.2.6). The function fails to properly validate or sanitize the property names extracted from Open Graph metadata, allowing an attacker to use payloads like "__proto__" or "constructor" to modify Object.prototype. This affects any application using the library to parse untrusted or attacker-controlled HTML. The attack requires network access to provide malicious HTML to the parser, but does not require authentication or user interaction. The fix (version 0.2.6) implements a blacklist filtering for dangerous property names.
Affected products
- Sam Holmes open-graph before 0.2.6
Timeline
- 2021-08-08: disclosed
- 2021-09-01: advisory
- 2021-08-30: patched: patch commit a0cef507a90adaac7dbbe9c404f09a50bdefb348