Executive brief
get-setter is a JavaScript library used to safely manage object property setters. The vulnerability allows an attacker to pollute the prototype chain, enabling unauthorized modification of properties on all objects in the application. This can lead to unexpected behavior, security bypasses, or data manipulation in any application using this library.
Technical details
The vulnerability is a prototype pollution flaw in the get-setter library. The set function does not properly validate or restrict modifications to an object's prototype, allowing an attacker to inject or modify properties on the Object prototype itself. This affects all versions of the library. An attacker can exploit this through crafted input to the set function to pollute the prototype chain, affecting all downstream objects. No patch is currently available; the advisory recommends using an alternative package.
Affected products
- npm get-setter all versions
Timeline
- 2020-09-04: disclosed