Executive brief
tree-kit is a JavaScript utility library used for manipulating tree-like data structures. A prototype pollution vulnerability in versions before 0.7.0 allows attackers to manipulate object prototypes, potentially enabling unauthorized modifications to application behavior or data integrity. This could lead to privilege escalation, bypassing security controls, or corrupting application logic.
Technical details
tree-kit contains a prototype pollution vulnerability (CWE-1321) in its `.path()` and `.dotPath()` functions that improperly handles object prototype attributes. The vulnerability allows an attacker with local code execution privileges to manipulate JavaScript object prototypes through crafted input to these functions. An attacker can exploit this to inject properties into Object.prototype, affecting all objects in the application and potentially causing unintended behavior across the codebase. The issue was patched in version 0.7.0 (commit a63f559c) which removed the subtree support from the vulnerable functions. Upgrading to version 0.7.0 or later resolves the vulnerability.
Affected products
- cronvel tree-kit before 0.7.0
Timeline
- 2022-12-25: disclosed
- 2022-12-25: patched: version 0.7.0 released