Executive brief
merge-change is a JavaScript library for deep merging and patching objects. A prototype pollution vulnerability in its utils.set function allows attackers to inject malicious properties into JavaScript objects, potentially leading to arbitrary code execution or application compromise in any application using this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-915) in the utils.set function within the merge-change library. The function does not properly validate property names when setting nested object properties, allowing an attacker to supply a specially crafted object path (e.g., "__proto__" or "constructor.prototype") that pollutes the Object prototype. The attack requires no authentication or user interaction and is triggered by calling the vulnerable function with attacker-controlled input. This allows an attacker to modify the behavior of all JavaScript objects in the application runtime, potentially enabling code execution or denial of service. The vulnerability affects all versions up to and including 1.8.1; patch status and fixed versions are not documented in the advisory.
Affected products
- Vladimir Shestakov merge-change up to 1.8.1
Timeline
- 2021-08-11: disclosed
- 2021-09-01: advisory