~ / search / GHSA-45rm-2893-5f49

GHSA-45rm-2893-5f49

liquidjs may leak properties of a prototype

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25948

Packages

EcosystemPackageAffectedFixed in
npm liquidjs < 10.0.0 10.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

The package liquidjs before 10.0.0 is vulnerable to Information Exposure when `ownPropertyOnly` parameter is set to `False`, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.

References

External links from the advisory. They lead to third-party sites.