~ / search / GHSA-89mq-4x47-5v83

GHSA-89mq-4x47-5v83

angular Prototype Pollution vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2019-10768

Packages

EcosystemPackageAffectedFixed in
npm angular < 1.7.9 1.7.9

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `angular ` prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function `merge()` does not restrict the modification of an Object's prototype in the , which may allow an attacker to add or modify an existing property that will exist on all objects. ## Recommendation Upgrade to version 1.7.9 or later. The function was already deprecated and upgrades are not expected to break functionality.

References

External links from the advisory. They lead to third-party sites.