Executive brief
@cookiex/deep is a JavaScript library used for deep operations on objects and cookies in Node.js and browser applications. A prototype pollution vulnerability allows attackers to manipulate the global prototype object, potentially enabling them to inject malicious properties that affect all object instances in an application. This could lead to unauthorized access, data corruption, or code execution depending on how the application uses affected objects.
Technical details
The @cookiex/deep library contains a prototype pollution vulnerability (CWE-1321, CWE-915) that allows unauthenticated remote attackers to pollute the global prototype object via the __proto__ property. The vulnerability exists in all versions prior to 0.0.7. No authentication or user interaction is required; the attack is network-accessible. An attacker can inject arbitrary properties into Object.prototype, which propagates to all objects in the application, potentially resulting in information disclosure, integrity violations, or denial of service. The vulnerability was patched in version 0.0.7 released in 2021.
Affected products
- cookiex @cookiex/deep before 0.0.7
Timeline
- 2021-09-17: disclosed: NVD published
- 2021-09-20: disclosed: GitHub advisory published
- 2021-09-20: patched: Fixed in version 0.0.7