Executive brief
The merge library is a Node.js utility for combining JavaScript objects. A prototype pollution vulnerability allows an attacker to modify the prototype of JavaScript objects, potentially injecting malicious properties into all objects in the application. This could lead to unauthorized data modification, authentication bypass, or remote code execution depending on how the affected application uses these objects.
Technical details
The merge library is vulnerable to Prototype Pollution (CWE-1321, CWE-915) due to improper validation of object properties during the merge operation. An attacker can craft a malicious payload with properties like "__proto__" or "constructor.prototype" that, when merged into a target object, pollute the JavaScript prototype chain. This requires network-reachable input but no authentication. An attacker can inject arbitrary properties into all objects within the application's runtime. The vulnerability is fixed in version 1.0.2 and later.
Affected products
- viking04 merge before 1.0.2
Timeline
- 2021-09-13: disclosed
- 2021-09-13: patched: Fixed in version 1.0.2