Description
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Remediation
References
https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada
https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324
https://github.com/firebase/firebase-js-sdk/pull/4001
Related Vulnerabilities
CVE-2023-44487 Vulnerability in maven package io.netty:netty-codec-http2
CVE-2022-4135 Vulnerability in npm package electron
CVE-2020-6429 Vulnerability in maven package org.webjars.npm:electron
CVE-2023-36472 Vulnerability in npm package @strapi/admin
CVE-2022-39135 Vulnerability in maven package org.apache.calcite:calcite-core