Executive brief
sey is a simple JavaScript build tool used to configure and build projects. A prototype pollution vulnerability in the deepmerge() function allows attackers to inject arbitrary properties into JavaScript object prototypes, potentially corrupting application behavior, modifying data, or causing denial of service across systems that use this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the deepmerge() function of sey, a JavaScript build tool. The defect allows an attacker to inject properties into Object.prototype by crafting malicious input that traverses and pollutes the prototype chain. The attack requires network access to supply malicious data to the deepmerge function, but does not require authentication or user interaction. Successful exploitation can result in integrity violations and availability impacts as polluted properties affect all objects in the application. All versions of sey through 0.3.0 are affected; the project was archived and deprecated as of August 2023.
Affected products
- eser sey 0.3.0 and earlier
Timeline
- 2021-12-16: disclosed
- 2023-08-22: other: Project archived and deprecated