GHSA-jgpq-g82g-6c39

confinit vulnerable to prototype pollution

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7638

Packages

Ecosystem	Package	Affected	Fixed in
npm	confinit	< 0.4.0	0.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7638 advisory
https://github.com/davideicardi/confinit/commit/a34e06ca5c1c8b047ef112ef188b2fe30d2a1eab web
https://snyk.io/vuln/SNYK-JS-CONFINIT-564433 web