Executive brief
nestie is a JavaScript utility library for nested object manipulation. A prototype pollution vulnerability allows attackers to modify the core JavaScript object prototype without authentication, potentially causing application crashes or enabling code execution through crafted input.
Technical details
nestie contains a prototype pollution vulnerability (CWE-1321, CWE-913) in versions 0.0.0 through 1.0.0 that allows an attacker to inject arbitrary properties into the Object prototype via specially crafted input. The vulnerability is network-accessible with no authentication or user interaction required. An attacker can cause denial of service by polluting the prototype or potentially achieve remote code execution depending on the application context. The issue was fixed in version 1.0.1 via commit bc80d58.
Affected products
- Luke Edwards nestie 0.0.0 through 1.0.0
Timeline
- 2021-06-03: disclosed
- 2021-06-04: patched: Fixed in version 1.0.1