Executive brief
comb is a JavaScript utility library providing toolkit functions for Node.js applications. A prototype pollution vulnerability in the deepMerge() function allows attackers to manipulate JavaScript object prototypes, potentially enabling injection of malicious properties that could affect application behavior and data integrity across all objects.
Technical details
A prototype pollution vulnerability exists in all versions of the comb npm package via the deepMerge() function (CWE-1321). The vulnerability allows an attacker to inject arbitrary properties into JavaScript object prototypes by crafting malicious input to the merge function. No authentication or user interaction is required; the attack is network-reachable if the application exposes the vulnerable deepMerge() function to untrusted input. Successful exploitation can result in integrity violations and denial of service by polluting Object.prototype with attacker-controlled values. The repository was archived on December 20, 2023, and affected all versions up to and including 2.0.0.
Affected products
- C2FO comb all versions up to 2.0.0
Timeline
- 2021-12-16: disclosed
- 2023-12-20: other: Repository archived by owner