Executive brief
Sails.js is a popular Node.js web framework used to build server applications. A prototype pollution vulnerability in its action module loader allows attackers to inject arbitrary properties into JavaScript objects, potentially causing application crashes or allowing property injection attacks that could bypass security controls or modify application behavior.
Technical details
This vulnerability is a prototype pollution flaw (CWE-1321) in the loadActionModules() function within controller/load-action-modules.js. The vulnerable code at lines 134–165 performs unsafe object assignment when processing action file paths; if an application dynamically controls the filePath variable, an attacker can supply a path traversal or specially crafted value that pollutes the JavaScript object prototype. No authentication or user interaction is required—the vulnerability is triggered via network-reachable input. An attacker can cause denial of service by crashing the application or inject arbitrary properties to bypass security controls or alter application logic. A patch is available in the master branch of the Sails.js GitHub repository.
Affected products
- Sails.js Sails.js through 1.5.2
Timeline
- 2022-03-15: disclosed: Vulnerability reported on GitHub issue #7209
- 2022-03-17: advisory: CVE-2021-44908 published on NVD
- 2022-03-18: advisory: GHSA-8v3j-jfg3-v3fv advisory published