Executive brief
upmerge is a JavaScript library used to merge and clone objects in web applications. A prototype pollution vulnerability in the merge() function allows attackers to modify inherited properties across all objects in an application, potentially causing service disruptions or enabling code execution.
Technical details
The vulnerability is a prototype pollution flaw in the merge() function that fails to sanitize user-controlled input before merging objects into the prototype chain. An unauthenticated attacker can craft malicious input containing special keys like "__proto__" or "constructor.prototype" to poison the Object prototype, affecting all objects created in the application. This occurs due to unsafe recursive object merging without property validation. No patch is currently available for any version of upmerge (all versions up to 0.1.8 are affected), and users are advised to migrate to an alternative library.
Affected products
- upmerge upmerge 0.1.8 and earlier
Timeline
- 2019-06-06: disclosed: Published as GHSA-gm9g-2g8v-fvxj