Description

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.

Remediation

References

https://github.com/VladimirShestakov/merge-change/blob/9901f145e06158f284f52de42e6ba5b0f702fb65/utils.js%23L89-L123

https://snyk.io/vuln/SNYK-JS-MERGECHANGE-1310985

Related Vulnerabilities

CVE-2021-3820 Vulnerability in npm package i

CVE-2022-24999 Vulnerability in npm package qs

CVE-2020-7624 Vulnerability in npm package effect

CVE-2021-35065 Vulnerability in npm package glob-parent

CVE-2023-5217 Vulnerability in npm package electron

Severity

Critical

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Third Party Advisory