GHSA-r659-8xfp-j327

objection.js Prototype Pollution vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-3766

Packages

Ecosystem	Package	Affected	Fixed in
npm	objection	< 2.2.16	2.2.16

Details

As written in the advisory (Markdown source, shown as plain text).

objection.js prior to version 2.2.16 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). This issue is patched in version 2.2.16.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3766 advisory
https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9 web
https://github.com/vincit/objection.js/commit/b41aab8dcd78f426f7468dcda541a7aca18a66a6 web
https://github.com/vincit/objection.js package
https://huntr.dev/bounties/c98e0f0e-ebf2-4072-be73-a1848ea031cc web