Description

undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

Remediation

References

https://github.com/remy/undefsafe/commit/f272681b3a50e2c4cbb6a8533795e1453382c822

https://snyk.io/vuln/SNYK-JS-UNDEFSAFE-548940

Related Vulnerabilities

CVE-2023-23850 Vulnerability in maven package org.jenkins-ci.plugins:synopsys-coverity

CVE-2021-45105 Vulnerability in maven package org.apache.logging.log4j:log4j-core

CVE-2019-10158 Vulnerability in maven package org.infinispan:infinispan-spring5-embedded

CVE-2020-14445 Vulnerability in maven package org.wso2.carbon.identity.framework:org.wso2.carbon.policyeditor.ui

CVE-2010-5312 Vulnerability in maven package org.fujion.webjars:jquery-ui

Severity

High

Classification

CWE-74 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Tags

Patch Third Party Advisory Exploit