Executive brief
The @akbr/update library is a JavaScript utility used to update object properties. A prototype pollution vulnerability in version 1.0.0 allows an attacker to modify the Object.prototype through special properties like __proto__ and constructor.prototype, potentially affecting all objects in an application. This can lead to unexpected application behavior, denial of service, or malicious code execution.
Technical details
The vulnerability is a prototype pollution issue in update/index.js (line 42) that allows untrusted input to modify the built-in Object.prototype. An attacker can pass specially crafted payloads with __proto__ or constructor.prototype properties to the library's update function, poisoning the prototype chain. The attack requires no authentication or user interaction; any application using @akbr/update version 1.0.0 with attacker-controlled input is at risk. This can enable denial of service attacks (by poisoning critical properties), property injection, or in severe cases, remote code execution depending on application logic. The vendor has not provided updates despite vulnerability disclosure.
Affected products
- akbr @akbr/update 1.0.0
Timeline
- 2024-06-17: disclosed: Vulnerability published to GitHub Advisory Database
- 2024-06-17: advisory: CVE-2024-36578 assigned