Executive brief
@antfu/utils is a popular JavaScript utility library used by many applications. A prototype pollution vulnerability in the deepMerge function allows attackers with low privileges to inject malicious properties into application objects, potentially compromising data integrity and application availability.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in the deepMerge function in @antfu/utils prior to version 0.7.3. The vulnerability allows an attacker with low privileges to inject malicious properties into JavaScript object prototypes by crafting specially-crafted input. This occurs when merging deeply nested objects without proper validation of property names. An authenticated network attacker can exploit this to modify the properties of all objects in the application, leading to unauthorized information disclosure and denial of service. The vulnerability was patched in version 0.7.3.
Affected products
- antfu utils <0.7.3
Timeline
- 2023-05-30: disclosed
- 2023-05-30: patched: Fixed in version 0.7.3