Executive brief
@bit/loader is a JavaScript module loader library. A prototype pollution vulnerability in the library's merge function allows an attacker to inject malicious properties into the Object prototype by supplying specially crafted JSON input. This could enable arbitrary code execution or modification of application behavior across all objects in a running application.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in @bit/loader v10.0.3 and earlier versions. The M function in index.js unsafely invokes a merge operation on the supplied argument without checking for prototype-related keys like __proto__. An attacker can craft malicious JSON containing a __proto__ property which, when merged into an empty object, pollutes the Object prototype and propagates malicious properties to all objects in the application. The attack requires user interaction or the application to load untrusted JSON input. No security patch is currently available; mitigation requires input sanitization to block __proto__ and constructor.prototype strings.
Affected products
- MiguelCastillo @bit/loader all versions up to and including 10.0.3
Timeline
- 2024-05-20: disclosed
- 2024-05-20: other: CVE-2024-24293 assigned