Description
This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.
Remediation
References
https://github.com/samholmes/node-open-graph/commit/a0cef507a90adaac7dbbe9c404f09a50bdefb348
https://snyk.io/vuln/SNYK-JS-OPENGRAPH-1536747
Related Vulnerabilities
CVE-2021-24033 Vulnerability in npm package react-dev-utils
CVE-2022-1233 Vulnerability in maven package org.webjars.bower:urijs
CVE-2019-1354 Vulnerability in maven package org.webjars.npm:nodegit
CVE-2021-23439 Vulnerability in npm package file-upload-with-preview
CVE-2021-46364 Vulnerability in maven package info.magnolia:magnolia-core