GHSA-ph28-wwfj-fv7f

Prototype Pollution in sds

Source: GitHub Advisory Database (reviewed) High CVE-2022-25862

Packages

Ecosystem	Package	Affected	Fixed in
npm	sds	<= 4.4.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to CVE-2020-7618

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7618 advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25862 advisory
https://github.com/monsterkodi/sds package
https://github.com/monsterkodi/sds/blob/master/js/set.js web
https://snyk.io/vuln/SNYK-JS-SDS-2385944 web