~ / search / GHSA-9534-h433-2rjf

GHSA-9534-h433-2rjf

Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify

Source: GitHub Advisory Database (reviewed) High CVE-2019-10808

Packages

EcosystemPackageAffectedFixed in
npm utilitify < 1.0.3 1.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.

References

External links from the advisory. They lead to third-party sites.