Executive brief
smart-extend is a Node.js library used to perform deep object merging and extension operations. A prototype pollution vulnerability in the deep() function allows attackers to modify the Object prototype itself, affecting all objects in the application. This can lead to property injection and unexpected behavior across the application.
Technical details
The vulnerability is a Prototype Pollution flaw (CWE-1321) in the deep() function of smart-extend. The vulnerable component fails to properly sanitize input during deep object merging, allowing attackers to inject properties into Object.prototype through specially crafted input objects. An attacker with the ability to control the input to the deep() function (typically via network input or user-supplied data) can add or modify properties that will exist on all objects in the application. No fix is currently available; users are advised to consider alternative modules.
Affected products
- smart-extend smart-extend all versions
Timeline
- 2020-09-02: disclosed