~ / search / GHSA-fwr7-v2mv-hh25

GHSA-fwr7-v2mv-hh25

Prototype Pollution in async

Source: GitHub Advisory Database (reviewed) High CVE-2021-43138

Packages

EcosystemPackageAffectedFixed in
npm async >= 3.0.0, < 3.2.2 3.2.2
npm async >= 2.0.0, < 2.6.4 2.6.4

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the `mapValues()` method.

References

External links from the advisory. They lead to third-party sites.