Executive brief
js-object-utilities is a JavaScript library for object manipulation used in Node.js applications. A prototype pollution vulnerability in the lib.set function allows an attacker to inject malicious properties into the global object prototype chain. This can cause application crashes or, in worse cases, enable arbitrary code execution if the polluted properties interact with sensitive Node.js APIs.
Technical details
The vulnerability is a prototype pollution flaw in the lib.set function (at /node_modules/js-object-utilities/dist/set.js:16:29) that fails to sanitize user-supplied property paths. An attacker can craft a payload using "__proto__" or similar prototype-chain manipulation techniques to inject or modify properties on Object.prototype. No authentication is required; the attack is network-reachable if the application exposes the vulnerable function. The consequences range from denial of service (application crashes due to polluted properties) to arbitrary code execution if the polluted properties propagate to sensitive Node.js APIs like exec or eval. A patch is available in version 2.2.1.
Affected products
- <UNKNOWN> js-object-utilities <=2.2.0
Timeline
- 2025-04-07: disclosed
- 2025-04-07: patched: Version 2.2.1 released