Description
undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Remediation
References
https://snyk.io/vuln/SNYK-JS-UNDEFSAFE-548940
https://github.com/remy/undefsafe/commit/f272681b3a50e2c4cbb6a8533795e1453382c822
Related Vulnerabilities
CVE-2021-43821 Vulnerability in maven package org.opencastproject:opencast-ingest-service-impl
CVE-2020-7726 Vulnerability in npm package safe-object2
CVE-2022-25854 Vulnerability in npm package @yaireo/tagify
CVE-2023-22465 Vulnerability in maven package org.http4s:http4s-core_2.13
CVE-2022-24913 Vulnerability in maven package com.fasterxml.util:java-merge-sort