Executive brief
reggae is a Node.js library used for dynamic object manipulation. The library fails to restrict modifications to an Object's prototype, allowing attackers to inject or modify properties that exist on all objects in the application. This can lead to unexpected application behavior, security bypass, or denial of service depending on how the affected code uses object properties.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in reggae's set function. The function does not validate or sanitize property assignments, allowing an attacker to modify Object.prototype and inject arbitrary properties into all object instances. This is a network-accessible vulnerability if reggae is used to process untrusted input. An attacker can leverage this to poison property chains, bypass security checks, or corrupt application state. No patch is currently available; the advisory recommends using an alternative package.
Affected products
- npm reggae all
Timeline
- 2020-09-04: disclosed