Description

confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

Remediation

References

https://github.com/davideicardi/confinit/commit/a34e06ca5c1c8b047ef112ef188b2fe30d2a1eab

https://snyk.io/vuln/SNYK-JS-CONFINIT-564433

Related Vulnerabilities

CVE-2020-13920 Vulnerability in maven package org.apache.activemq:activemq-core

CVE-2021-32691 Vulnerability in npm package data-connector-rock

CVE-2021-29481 Vulnerability in maven package io.ratpack:ratpack-session

CVE-2019-10744 Vulnerability in npm package @sailshq/lodash

CVE-2018-1109 Vulnerability in npm package braces

Severity

Medium

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Patch Third Party Advisory Exploit