Executive brief
flat-wrap is a Node.js utility library for flattening and unflattening JavaScript objects. A prototype pollution vulnerability in the unflatten function allows attackers to add or modify properties on all objects in an application, potentially enabling denial of service, authentication bypass, or code execution depending on how the library is used.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the unflatten function of flat-wrap. The function does not properly validate or restrict modifications to the Object prototype when processing flattened object structures. An attacker can craft a malicious flattened input containing keys like "__proto__" or "constructor.prototype" to inject arbitrary properties onto the global Object prototype, which will then exist on all objects. This affects all versions of the library and is network-reachable if the unflatten function processes untrusted input. No patch is currently available.
Affected products
- npm flat-wrap all versions
Timeline
- 2020-09-04: disclosed
- 2020-09-04: advisory