~ / search / GHSA-58g2-9fqr-36q2

GHSA-58g2-9fqr-36q2

Prototype Pollution in Proto

Source: GitHub Advisory Database (reviewed) High CVE-2021-23426

Packages

EcosystemPackageAffectedFixed in
npm Proto <= 1.1.4 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.

References

External links from the advisory. They lead to third-party sites.