~ / search / GHSA-jg8v-48h5-wgxg

GHSA-jg8v-48h5-wgxg

jszip Vulnerable to Prototype Pollution

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23413

Packages

EcosystemPackageAffectedFixed in
npm jszip >= 3.0.0, < 3.7.0 3.7.0
npm jszip < 2.7.0 2.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g `__proto__`, `toString`, etc) results in a returned object with a modified prototype instance.

References

External links from the advisory. They lead to third-party sites.