Executive brief
patchmerge is a JavaScript library for merging configuration objects and data structures. A prototype pollution vulnerability allows attackers to inject malicious properties into core JavaScript objects, potentially causing application crashes or enabling remote code execution across systems using the affected library.
Technical details
A prototype pollution vulnerability exists in patchmerge versions 1.0.0 through 1.0.1, where the objectMerge function fails to validate input when merging objects, allowing attackers to inject properties into Object.prototype. This is a CWE-1321 vulnerability that requires no authentication or user interaction—the attacker simply supplies a specially crafted payload to the merge function via a network request or data input. Exploitation can cause denial of service through application crashes or lead to remote code execution by polluting inherited properties. The vulnerability was fixed in version 1.0.2 by adding prototype checks to prevent inadvertent Object.prototype modification.
Affected products
- pjshumphreys patchmerge 1.0.0 through 1.0.1
Timeline
- 2021-03-16: disclosed: CVE-2021-25916 published to NVD
- 2021-10-06: patched: GitHub advisory published; fix available in version 1.0.2
- 2021-10-13: advisory: GHSA-84g3-cv89-m9gm published