Executive brief
Baobab is a state management library for JavaScript applications. A prototype pollution vulnerability allows remote attackers to modify JavaScript object properties, potentially leading to data corruption, application malfunction, or code execution depending on how the application uses the affected library.
Technical details
This vulnerability is a prototype pollution flaw (CWE-1321) in Baobab up to version 2.6.0. The vulnerability stems from improperly controlled modification of object prototype attributes, allowing attackers to pollute the prototype chain. The attack can be launched remotely without authentication or user interaction. An attacker can manipulate the prototype of JavaScript objects to inject or modify properties, potentially affecting all objects created after the pollution occurs. The issue is fixed in version 2.6.1 (commit c56639532a923d9a1600fb863ec7551b188b5d19).
Affected products
- Yomguithereal Baobab up to 2.6.0
Timeline
- 2023-01-07: disclosed
- 2021-01-26: patched: Fix merged in PR #511