Executive brief
safe-object2 is a JavaScript utility library used to safely manipulate object properties. The library contains a prototype pollution vulnerability that allows an attacker to modify core JavaScript object properties, potentially affecting all objects in an application and leading to unexpected behavior or security bypass.
Technical details
The setter() function in safe-object2 does not properly restrict modification of an Object's prototype chain. This prototype pollution vulnerability (CWE-1321) allows an attacker to inject or modify properties on the Object prototype, which will be inherited by all objects in the JavaScript runtime. No authentication or special preconditions are required; an attacker with the ability to call setter() with arbitrary parameters can exploit this. The vulnerability affects all versions of safe-object2. As of the advisory publication date, no patch has been released and the maintainers recommend using an alternative package.
Affected products
- npm safe-object2 all versions
Timeline
- 2020-09-04: disclosed