Executive brief
The mergify library, a utility used for merging JavaScript objects, contains a security flaw known as prototype pollution. This vulnerability allows an attacker to inject properties into the base structure of all objects within the application. Depending on how the application is built, this could lead to unexpected behavior, application crashes, or potential security bypasses.
Technical details
The mergify() function in all versions of the mergify package is vulnerable to prototype pollution (CWE-1321). By providing specially crafted input containing properties like '__proto__', an attacker can modify the global Object prototype. This allows for the addition or modification of properties that are inherited by all JavaScript objects in the runtime environment. Successful exploitation can lead to denial of service or, in some cases, remote code execution depending on the application's logic. No patch is available as the package is deprecated; users are advised to migrate to an alternative library.
Affected products
- mergify mergify All versions
Timeline
- 2020-09-11: advisory: GitHub Advisory published