Executive brief
just-safe-set is a JavaScript utility library used for safely setting object properties. A prototype pollution vulnerability allows attackers to modify object prototypes, potentially causing denial of service or remote code execution in applications that depend on this library.
Technical details
The just-safe-set library contains a prototype pollution vulnerability (CWE-1321, CWE-915) in versions 1.0.0 through 2.2.1 that allows attackers to pollute object prototypes via unsafe property assignment. The vulnerability is exploitable remotely without authentication or user interaction, as the library does not properly validate or filter property names that could target the object prototype chain. An attacker can exploit this by passing specially crafted input to the library's property-setting functions to inject malicious properties into Object.prototype, affecting all objects in the application. This can lead to denial of service through prototype chain manipulation or, in some configurations, remote code execution. The fix is available in version 2.2.2 and later.
Affected products
- just (angus-c) just-safe-set 1.0.0 through 2.2.1
Timeline
- 2021-07-07: disclosed
- 2021-05-08: patched: Fix merged via PR #267
- 2021-12-10: advisory: GHSA-v26w-gcxh-v4r7 published