Executive brief
@intlify/shared is a utility library used by Vue.js internationalization frameworks to handle language translation and localization features. A prototype pollution vulnerability in the deepCopy function allows attackers to inject malicious properties into JavaScript's global object prototype, potentially causing application crashes or enabling injection attacks that could lead to arbitrary code execution depending on how the application uses the library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the deepCopy function of @intlify/shared versions 9.7.0–10.0.4. An attacker can craft a JSON payload containing __proto__ properties that, when passed to deepCopy, pollutes the Object.prototype chain with arbitrary properties. The attack requires no authentication and can be triggered via network with a malicious JSON input. While the minimum impact is denial of service (application instability), the severity escalates if polluted properties propagate to sensitive Node.js APIs such as exec or eval, potentially enabling remote code execution. Patches are available in versions 9.14.2, 10.0.5, and later.
Affected products
- Intlify @intlify/shared 9.7.0–10.0.4
- Intlify @intlify/vue-i18n-core 9.7.0–10.0.4
- Intlify vue-i18n 9.7.0–10.0.4
- Intlify petite-vue-i18n 10.0.0–10.0.4
Timeline
- 2024-11-28: disclosed
- 2024-12-02: advisory