GHSA-587p-w43q-4hjx
query-parser-string is vulnerable to Prototype Pollution
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | query-string-parser | 1.0.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly created object.
References
External links from the advisory. They lead to third-party sites.