Executive brief
vxe-table is a popular Vue.js table component library used in many web applications. A prototype pollution vulnerability allows attackers to inject malicious properties into the JavaScript object prototype chain by supplying crafted input to the install or setup functions. This can cause denial of service or potentially enable more severe attacks like code execution if the polluted properties reach sensitive APIs.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the lib.install and lib.setup functions of vxe-table v4.8.10 and earlier. An attacker can craft a payload containing __proto__ properties (e.g., {"__proto__":{"pollutedKey":123}}) that, when processed by these functions, pollutes the global Object.prototype. The attack requires network access and no authentication, but typically requires the application to accept untrusted user input. While the immediate impact is denial of service through prototype corruption, the consequences could escalate to arbitrary code execution if polluted properties propagate to sensitive Node.js APIs like exec or eval. Patches should be available in newer versions.
Affected products
- x-extends vxe-table 4.8.10 and earlier
Timeline
- 2025-02-06: disclosed
- 2024-12-10: other: Vulnerability reported