Executive brief
@rpldy/uploader is a popular JavaScript library for handling file uploads in web applications. A prototype pollution vulnerability in the createUploader function allows attackers to craft malicious payloads that cause the upload service to crash, resulting in denial of service and disruption of file upload functionality for users.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the lib.createUploader function of @rpldy/uploader version 1.8.1 and earlier. An attacker can supply a specially crafted payload to pollute the JavaScript prototype chain, causing a Denial of Service condition. The attack requires network access to an application using the vulnerable library and does not require authentication or user interaction. The fix was patched in version 1.9.1, as evidenced by commit 386e0a80 that explicitly protects against prototype pollution.
Affected products
- rpldy uploader <1.9.1
Timeline
- 2025-02-06: disclosed
- 2025-02-07: patched: Fixed in version 1.9.1