GHSA-8v3j-jfg3-v3fv

Prototype Pollution in Sails.js

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-44908

Packages

Ecosystem	Package	Affected	Fixed in
npm	sails	<= 1.5.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Sails.js <= 1.5.2 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules(). A [patch](https://github.com/balderdashy/sails/commit/7c5379a656bb305c958df1dcc2b51a9668830358) is available in the `master` branch of Sails.js's GItHub repository.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-44908 advisory
https://github.com/balderdashy/sails/issues/7209 web
https://github.com/balderdashy/sails/commit/7c5379a656bb305c958df1dcc2b51a9668830358 web
https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/sailsJS%20PoC.zip web
https://github.com/balderdashy/sails package
https://github.com/balderdashy/sails/blob/master/lib/app/private/controller/load-action-modules.js#L32 web