Description

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Remediation

References

https://github.com/advisories/GHSA-ff7x-qrg7-qggm

https://github.com/sindresorhus/dot-prop/issues/63

https://github.com/sindresorhus/dot-prop/tree/v4

https://hackerone.com/reports/719856

Related Vulnerabilities

CVE-2016-10652 Vulnerability in npm package prebuild-lwip

CVE-2019-10357 Vulnerability in maven package org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

CVE-2022-39368 Vulnerability in maven package org.eclipse.californium:element-connector

CVE-2022-45921 Vulnerability in maven package io.fusionauth:fusionauth-java-client

CVE-2022-22984 Vulnerability in npm package @snyk/snyk-cocoapods-plugin

Severity

High

Classification

CWE-471 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Third Party Advisory Issue Tracking Patch Broken Link Exploit