Executive brief
The unflatten package is a JavaScript library that converts flat key-value objects into nested structures. It contains a prototype pollution vulnerability that allows attackers to add or modify properties on all objects in an application, potentially leading to unexpected behavior, bypassed security controls, or denial of service.
Technical details
The vulnerability is a prototype pollution issue (CWE-1321) in the unflatten function. The function does not properly validate or sanitize input when reconstructing nested objects, allowing attackers to modify the Object prototype by injecting specially crafted keys (such as "__proto__", "constructor.prototype", or "prototype"). This affects all versions of the unflatten package. An attacker can exploit this by passing a malicious flattened object to the unflatten function, which does not require authentication or special network access. The impact ranges from application logic bypass to denial of service depending on how polluted properties are used by the application. No patch is currently available; users are advised to switch to alternative packages.
Affected products
- unflatten unflatten all versions
Timeline
- 2020-09-04: disclosed
- 2020-08-31: advisory