CVE-2018-16469: Prototype Pollution in merge
Summary
CVE-2018-16469: Prototype Pollution in merge. Affects merge versions < 1.2.1. Fixed in 1.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The merge package is an npm package that provides a function called merge.recursive for merging JavaScript objects. It is commonly used in applications that require merging objects with nested properties. However, versions of merge before 1.2.1 are vulnerable to prototype pollution. This means that the merge.recursive function can be tricked into adding or modifying properties of the Object prototype.
Vulnerability Detail
The vulnerability in the merge package allows an attacker to manipulate the behavior of the affected application by polluting the prototype of the Object. By crafting a malicious object with specially crafted properties, an attacker can modify or add properties to the Object prototype, which can lead to unexpected behavior or security vulnerabilities in the application. This can potentially result in remote code execution, information disclosure, or denial of service.
How To Fix
Minimum fixed version
1.2.1
This is the first release that contains the fix.
npm install merge@1.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the merge package as soon as possible.
Conclusion
The merge package before version 1.2.1 is vulnerable to prototype pollution, which can lead to unexpected behavior or security vulnerabilities in the affected application. It is crucial to update to version 1.2.1 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for merge →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, allowing them to add or modify properties that affect all instances of that object.
This vulnerability can lead to unexpected behavior or security vulnerabilities in the affected application. It can potentially result in remote code execution, information disclosure, or denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the moment. However, it is still important to update to the fixed version of the merge package to mitigate the risk.
You can find more information about this vulnerability in the GitHub Security Advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-f9cm-qmx5-m98h/GHSA-f9cm-qmx5-m98h.json
Related vulnerabilities
Recent vulnerabilities recorded for merge.
