Description

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.

Remediation

References

https://snyk.io/vuln/SNYK-JS-RDFGRAPHARRAY-551803

https://github.com/rdf-ext-archive/rdf-graph-array/blob/master/index.js#L211

Related Vulnerabilities

CVE-2015-10005 Vulnerability in npm package markdown-it

CVE-2023-22465 Vulnerability in maven package org.http4s:http4s-core_2.12

CVE-2019-10907 Vulnerability in maven package org.airsonic.player:airsonic-main

CVE-2019-10361 Vulnerability in maven package org.jenkins-ci.plugins.m2release:m2release

CVE-2019-10061 Vulnerability in npm package opencv

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Third Party Advisory Exploit Tool Signature NVD-CWE-noinfo