Description

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.

Remediation

References

https://snyk.io/vuln/SNYK-JS-RDFGRAPHARRAY-551803

https://github.com/rdf-ext-archive/rdf-graph-array/blob/master/index.js#L211

Related Vulnerabilities

CVE-2014-9515 Vulnerability in maven package com.github.dozermapper:dozer-parent

CVE-2012-0803 Vulnerability in maven package org.apache.cxf:cxf-rt-ws-security

CVE-2016-10616 Vulnerability in npm package openframe-image

CVE-2019-10744 Vulnerability in maven package org.webjars.npm:lodash

CVE-2022-39263 Vulnerability in npm package next-auth

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Third Party Advisory Exploit Tool Signature NVD-CWE-noinfo