Executive brief
sahmat is a JavaScript utility library available via npm. The package contains a prototype pollution vulnerability that allows attackers to modify the prototype of JavaScript objects, potentially adding or altering properties that would affect all instances of those objects application-wide. This could lead to unexpected behavior, logic bypasses, or data manipulation depending on how the library is used in applications.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the sahmat npm package affecting all versions. The vulnerability stems from insufficient input validation or sanitization when processing object properties, allowing an attacker to inject properties into Object.prototype. The attack vector is network-based, triggered when the library processes untrusted data (such as user input or external API responses). An attacker can exploit this to modify or add properties that will propagate to all objects in the application, potentially enabling authorization bypasses, information disclosure, or denial of service. No patch is currently available; users are advised to switch to an alternative package.
Affected products
- <UNKNOWN> sahmat all versions
Timeline
- 2020-09-04: disclosed
- 2020-08-31: advisory