~ / search / GHSA-v9p9-535w-4285

GHSA-v9p9-535w-4285

Prototype Pollution in litespeed.js and appwrite/server-ce

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23682

Packages

EcosystemPackageAffectedFixed in
npm litespeed.js < 0.3.12 0.3.12
Packagist appwrite/server-ce >= 0.12.0, < 0.12.2 0.12.2
Packagist appwrite/server-ce < 0.11.1 0.11.1

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.

References

External links from the advisory. They lead to third-party sites.