Executive brief
@stryker-mutator/util is a JavaScript utility library used by the Stryker mutation testing framework. A prototype pollution vulnerability in the deepMerge function allows attackers to cause denial of service by submitting specially crafted payloads, disrupting testing operations and build pipelines that depend on this library.
Technical details
A prototype pollution vulnerability exists in the deepMerge function of @stryker-mutator/util version 8.6.0 and earlier. The vulnerability is caused by improper input validation when merging nested objects, allowing an attacker to inject properties into the Object prototype via crafted payload objects. This can be exploited over the network without authentication to cause denial of service conditions. The vulnerability was patched in version 8.7.1 (released 2024-12-11).
Affected products
- Stryker Mutator @stryker-mutator/util before 8.7.1
Timeline
- 2025-02-06: disclosed: GHSA advisory published
- 2024-12-11: patched: Fix released in version 8.7.1