~ / search / GHSA-c4w7-xm78-47vh

GHSA-c4w7-xm78-47vh

Prototype Pollution in y18n

Source: GitHub Advisory Database (reviewed) High CVE-2020-7774

Packages

EcosystemPackageAffectedFixed in
npm y18n < 3.2.2 3.2.2
npm y18n >= 4.0.0, < 4.0.1 4.0.1
npm y18n >= 5.0.0, < 5.0.5 5.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Overview The npm package `y18n` before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution. ### POC ```js const y18n = require('y18n')(); y18n.setLocale('__proto__'); y18n.updateLocale({polluted: true}); console.log(polluted); // true ``` ### Recommendation Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.

References

External links from the advisory. They lead to third-party sites.