Executive brief
RequireJS is a JavaScript module loader used to manage code dependencies in web applications. A prototype pollution vulnerability in the configure function allows attackers to inject arbitrary properties into JavaScript objects, potentially leading to unauthorized code execution or application crashes without requiring authentication or user interaction.
Technical details
A prototype pollution vulnerability exists in requirejs v2.3.6 in the s.contexts._.configure function (CWE-1321). The vulnerability allows attackers to inject arbitrary properties into the prototype chain via specially crafted configuration objects, which can be exploited to execute arbitrary code or cause denial of service. The attack requires network reachability to an application using the vulnerable version but does not require authentication or user interaction. The vulnerability has been fixed in version 2.3.7.
Affected products
- jrburke requirejs <= 2.3.6
Timeline
- 2024-07-01: disclosed
- 2024-07-01: patched: Fixed in version 2.3.7