Executive brief
min-dash is a JavaScript utility library used in BPMN diagram tools. A prototype pollution vulnerability in the object-set function could allow an attacker to modify the base Object prototype, potentially affecting application behavior and enabling denial-of-service or information disclosure attacks.
Technical details
The vulnerability is a prototype pollution flaw in the min-dash library's object#set function. An attacker can craft malicious input (e.g., set({}, [["__proto__"], "polluted"], "success")) to inject properties into the JavaScript Object prototype itself. This occurs because the function does not properly validate or enforce key types, allowing special keys like "__proto__" to be processed. The vulnerability is remotely exploitable if min-dash is used in a web application that processes untrusted input. A fix was implemented in PR #21 to enforce key types and prevent prototype pollution.
Affected products
- bpmn-io min-dash
Timeline
- 2022-01-27: disclosed
- 2022-01-17: patched