GHSA-gmwp-3pwc-3j3g

mockery is vulnerable to prototype pollution

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-37614

Packages

Ecosystem	Package	Affected	Fixed in
npm	mockery	<= 2.1.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-37614 advisory
https://github.com/mfncooper/mockery/issues/77 web
https://github.com/mfncooper/mockery package
https://github.com/mfncooper/mockery/blob/822f0566fd6d72af8c943ae5ca2aa92e516aa2cf/mockery.js#L119 web
https://github.com/mfncooper/mockery/blob/822f0566fd6d72af8c943ae5ca2aa92e516aa2cf/mockery.js#L62 web