Executive brief
Grunt-karma is a Node.js build tool plugin used by developers to run automated tests. The vulnerability allows attackers to inject malicious code into the application's core object structure, potentially enabling unauthorized access to sensitive data, modification of application behavior, or denial of service.
Technical details
A prototype pollution vulnerability exists in grunt-karma version 4.0.1 in the grunt-karma.js file, specifically via improper handling of the key variable. Prototype pollution allows an attacker to inject properties into the Object prototype, affecting all objects in the JavaScript runtime. This vulnerability is network-accessible with no authentication or user interaction required (CVSS vector: AV:N/AC:L/PR:N/UI:N). An attacker can achieve complete compromise including confidentiality, integrity, and availability impacts. The vulnerability affects all versions up to and including 4.0.1; patch information is available through the project repository.
Affected products
- karma-runner grunt-karma 4.0.1 and earlier
Timeline
- 2022-10-05: disclosed
- 2022-10-14: advisory