Executive brief
immer is a popular JavaScript library used for managing immutable state in applications. A prototype pollution vulnerability allows attackers to modify core JavaScript object properties through specially crafted patch operations, potentially causing application-wide denial of service or unexpected behavior in all objects created after the attack.
Technical details
immer is vulnerable to prototype pollution (CWE-1321, CWE-915) in its patch handling mechanism. The vulnerability allows an attacker to pollute the Object prototype by crafting malicious patch operations with paths like `["__proto__"], "x"`. The attack is network-accessible and requires no authentication or user interaction. An attacker can modify prototype attributes on the target application, leading to denial of service or arbitrary behavior modification. The vulnerability was introduced in version 7.0.0 and is fixed in version 9.0.6.
Affected products
- Immer immer 7.0.0 to 9.0.5
Timeline
- 2021-09-07: disclosed
- 2021-09-03: patched: Fix commit: fa671e5