Description

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Remediation

References

https://hackerone.com/reports/719856

https://github.com/sindresorhus/dot-prop/issues/63

https://github.com/sindresorhus/dot-prop/tree/v4

https://github.com/advisories/GHSA-ff7x-qrg7-qggm

Related Vulnerabilities

CVE-2022-37258 Vulnerability in npm package steal

CVE-2020-7739 Vulnerability in npm package phantomjs-seo

CVE-2022-25350 Vulnerability in npm package puppet-facter

CVE-2022-32210 Vulnerability in npm package undici

CVE-2023-27095 Vulnerability in maven package cn.hippo4j:hippo4j-core

Severity

High

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Exploit Third Party Advisory Issue Tracking Patch Broken Link