CVE-2024-52810: Intlify shared prototype pollution in deepCopy

CVE-2024-52810 · Severity: medium · CVSS 4 · Published 2024-12-02

@intlify/shared is a utility library used by Vue.js internationalization frameworks to handle language translation and localization features. A prototype pollution vulnerability in the deepCopy function allows attackers to inject malicious properties into JavaScript's global object prototype, potentially causing application crashes or enabling injection attacks that could lead to arbitrary code execution depending on how the application uses the library.

Technologies: @intlify/vue-i18n-core (npm), petite-vue-i18n (npm), vue-i18n (npm). Vendors: npm.

Quick answers

Is CVE-2024-52810 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-52810 being exploited in the wild.
How severe is CVE-2024-52810?
Medium severity, with a CVSS score of 4, published 2 December 2024.
Which products and versions are affected?
@intlify/shared (npm) SEMVER:introduced=9.7.0,fixed=9.14.2; @intlify/vue-i18n-core (npm) SEMVER:introduced=9.7.0,fixed=9.14.2; petite-vue-i18n (npm) SEMVER:introduced=10.0.0,fixed=10.0.5; vue-i18n (npm) SEMVER:introduced=9.7.0,fixed=9.14.2.
Is there a fix for CVE-2024-52810?
Yes. @intlify/shared (npm): upgrade to 9.14.2 or later; @intlify/vue-i18n-core (npm): upgrade to 9.14.2 or later; petite-vue-i18n (npm): upgrade to 10.0.5 or later; vue-i18n (npm): upgrade to 9.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-52810 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-52810?
Check whether you run @intlify/shared (npm), @intlify/vue-i18n-core (npm), petite-vue-i18n (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @intlify/shared (npm): upgrade to 9.14.2 or later
    npm install @intlify/shared@9.14.2
  • @intlify/vue-i18n-core (npm): upgrade to 9.14.2 or later
    npm install @intlify/vue-i18n-core@9.14.2
  • petite-vue-i18n (npm): upgrade to 10.0.5 or later
    npm install petite-vue-i18n@10.0.5
  • vue-i18n (npm): upgrade to 9.14.2 or later
    npm install vue-i18n@9.14.2

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in the deepCopy function of @intlify/shared versions 9.7.0–10.0.4. An attacker can craft a JSON payload containing __proto__ properties that, when passed to deepCopy, pollutes the Object.prototype chain with arbitrary properties. The attack requires no authentication and can be triggered via network with a malicious JSON input. While the minimum impact is denial of service (application instability), the severity escalates if polluted properties propagate to sensitive Node.js APIs such as exec or eval, potentially enabling remote code execution. Patches are available in versions 9.14.2, 10.0.5, and later.

Affected products

  • Intlify @intlify/shared 9.7.0–10.0.4
  • Intlify @intlify/vue-i18n-core 9.7.0–10.0.4
  • Intlify vue-i18n 9.7.0–10.0.4
  • Intlify petite-vue-i18n 10.0.0–10.0.4

Identifiers

  • CVE-2024-52810
  • GHSA-hjwq-mjwj-4x6c

Timeline

  • 2024-11-28: disclosed
  • 2024-12-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.