GHSA-f9cm-qmx5-m98h

Prototype Pollution in merge

Source: GitHub Advisory Database (reviewed) High CVE-2018-16469

Packages

Ecosystem	Package	Affected	Fixed in
npm	merge	< 1.2.1	1.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `merge` before 1.2.1 are vulnerable to prototype pollution. The `merge.recursive` function can be tricked into adding or modifying properties of the Object prototype. ## Recommendation Update to version 1.2.1 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-16469 advisory
https://hackerone.com/reports/381194 web
https://github.com/advisories/GHSA-f9cm-qmx5-m98h advisory
https://www.npmjs.com/advisories/722 web