~ / search / GHSA-6hwh-rqwf-cxxr

GHSA-6hwh-rqwf-cxxr

Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10806

Packages

EcosystemPackageAffectedFixed in
npm vega-util < 1.13.1 1.13.1

Details

As written in the advisory (Markdown source, shown as plain text).

vega-util prior to 1.13.1 allows manipulation of object prototype. The &#39;vega.mergeConfig&#39; method within vega-util could be tricked into adding or modifying properties of the Object.prototype.

References

External links from the advisory. They lead to third-party sites.