Executive brief
lutils-merge is a deprecated Node.js library used to merge objects in JavaScript applications. A prototype pollution vulnerability in its merge() function allows attackers to modify the prototype of all objects in an application, potentially causing denial of service or chaining with other flaws to achieve remote code execution.
Technical details
The vulnerability is a prototype pollution (CWE-400) in the merge() function of lutils-merge. The function fails to sanitize user-controlled input before using it to modify object properties, allowing attackers to inject properties into Object.prototype. This affects all versions up to and including 0.2.6. The attack requires only network access with no authentication or user interaction needed. Successful exploitation can lead to denial of service by corrupting object properties across the application, or potentially remote code execution when combined with other vulnerabilities. No patch is available; the package is deprecated.
Affected products
- lutils-merge lutils-merge 0 through 0.2.6
Timeline
- 2018-11-22: disclosed: Issue reported to GitHub
- 2019-06-13: advisory: GHSA advisory published