Executive brief
expand-hash is a JavaScript library used to expand dot-notation object keys into nested objects. A prototype pollution vulnerability in versions 0.1.0 through 1.0.1 allows attackers to inject arbitrary properties into all objects, potentially causing application crashes or remote code execution depending on how the library is used.
Technical details
A prototype pollution vulnerability exists in expand-hash due to unsafe handling of object property assignment. The vulnerability allows attackers to inject properties into Object.prototype by crafting specially formatted input with dot-notation keys (e.g., '__proto__' or 'constructor.prototype'). No authentication or user interaction is required; the vulnerability is triggered by processing untrusted input. Attackers can achieve denial of service through prototype pollution that corrupts all objects in the application, or potentially remote code execution if the polluted properties are leveraged by other code execution paths. Patches are available in versions after 1.0.1.
Affected products
- expand-hash expand-hash 0.1.0 through 1.0.1
Timeline
- 2021-06-21: disclosed: GHSA advisory published
- 2021-06-10: other: NVD entry published