Executive brief
@akbr/patch-into is a JavaScript utility library used to apply patches to objects. A prototype pollution vulnerability in its patchInto function allows an authenticated attacker to inject malicious properties into the JavaScript Object prototype, potentially enabling arbitrary code execution, service disruption, or cross-site scripting attacks across all dependent code.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the patchInto function within @akbr/patch-into version 1.0.1. An attacker with low privileges can pass specially crafted arguments containing the __proto__ property to patchInto, modifying Object.prototype and poisoning the behavior of all objects that inherit from it. Network accessibility is required, but authentication is mandated by the CVSS vector. Successful exploitation enables arbitrary code execution, denial of service, or cross-site scripting depending on gadgets available in the attacked application. No patch information is currently available in the advisory.
Affected products
- akbr patch-into 1.0.1
Timeline
- 2024-07-01: disclosed: Vulnerability published to advisory database