Description
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Remediation
References
https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada
https://github.com/firebase/firebase-js-sdk/pull/4001
https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324
Related Vulnerabilities
CVE-2017-5617 Vulnerability in maven package com.metsci.ext.com.kitfox.svg:svg-salamander
CVE-2023-23848 Vulnerability in maven package org.jenkins-ci.plugins:synopsys-coverity
CVE-2011-5063 Vulnerability in maven package org.apache.tomcat:catalina
CVE-2021-37701 Vulnerability in npm package tar
CVE-2010-2076 Vulnerability in maven package org.apache.cxf:cxf-common-utilities