Executive brief
jsgui-lang-essentials is a JavaScript utility library used for working with objects and properties. The library contains a prototype pollution vulnerability that allows attackers to modify core JavaScript object prototypes (like `__proto__`, `constructor`, and `prototype`), potentially leading to property injection, logic bypass, or code execution in applications that use this library.
Technical details
The vulnerability is a prototype pollution flaw in the `ll_set()` function that fails to restrict modification of magical object attributes. An attacker can craft input that traverses or directly sets `__proto__`, `constructor`, or `prototype` properties, polluting the JavaScript prototype chain. This is a network-based attack with no authentication or user interaction required; any application using the library to process untrusted input is at risk. Successful exploitation can corrupt application state, bypass security checks, or achieve remote code execution depending on how the polluted properties are used. All versions up to and including 0.4.3 are affected; a patch or update availability is not documented in the advisory.
Affected products
- jsgui-lang-essentials jsgui-lang-essentials 0 to 0.4.3
Timeline
- 2021-12-13: disclosed: Vulnerability reported on GitHub
- 2022-05-01: advisory: NVD published CVE-2022-25301
- 2022-05-03: advisory: GHSA-p3pg-64pv-v7jg published