Executive brief
The 101 library is a JavaScript utility library used by developers to simplify common programming tasks. A prototype pollution vulnerability in versions 1.0.0 through 1.6.3 allows unauthenticated attackers to manipulate the behavior of the library and potentially other code that depends on it, leading to denial of service or remote code execution.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in the 101 library's set.js file, affecting versions 1.0.0 through 1.6.3. The vulnerability allows attackers to pollute the Object prototype by passing specially crafted input, which can affect the behavior of all objects in the application. The attack is network-reachable and requires no authentication or user interaction. Successful exploitation can lead to denial of service or remote code execution depending on how the library is used within an application. A patch is available in versions after 1.6.3.
Affected products
- Tejpal Mehta 101 1.0.0 through 1.6.3
Timeline
- 2021-05-17: disclosed
- 2021-05-14: advisory: CVE-2021-25943 published by NVD