Executive brief
libnested is a JavaScript library for manipulating nested objects and arrays. A prototype pollution vulnerability in its set function allows attackers to inject malicious properties into JavaScript object prototypes, potentially leading to application logic bypass, denial of service, or remote code execution depending on how the application uses the polluted objects.
Technical details
This is a prototype pollution vulnerability in the set function of libnested (index.js) affecting versions before 1.5.2. The vulnerability stems from an incomplete fix for a prior prototype pollution issue (CVE-2020-28283). The flaw allows an attacker to manipulate object properties through specially crafted input that pollutes the Object prototype or constructor properties. The attack vector is network-based with no authentication or user interaction required. An attacker can exploit this to modify application behavior, cause denial of service, or in some contexts achieve remote code execution. The fix was released in version 1.5.2.
Affected products
- dominictarr libnested before 1.5.2
Timeline
- 2022-03-18: disclosed
- 2022-03-18: patched: Fixed in version 1.5.2