CVE-2020-28499: Prototype Pollution in merge
Summary
CVE-2020-28499: Prototype Pollution in merge. Affects merge versions < 2.1.1. Fixed in 2.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'merge' package is an npm package used for merging JavaScript objects. It provides a function called '_recursiveMerge' that is vulnerable to Prototype Pollution. Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues. In this case, all versions of the 'merge' package prior to version 2.1.1 are affected.
Vulnerability Detail
The vulnerability in the 'merge' package arises from the insecure handling of user-controlled input during the merging process. By manipulating the input, an attacker can inject malicious properties into the prototype of an object, potentially leading to code execution or privilege escalation. This can have severe consequences, such as unauthorized access to sensitive data or the ability to modify critical system functionality.
How To Fix
Minimum fixed version
2.1.1
This is the first release that contains the fix.
npm install merge@2.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround is to sanitize and validate any user-controlled input before passing it to the '_recursiveMerge' function. This can be done by implementing input validation and filtering techniques, such as using a library like 'validator.js' to sanitize the input.
Conclusion
In conclusion, the 'merge' package is vulnerable to Prototype Pollution, which can have severe consequences. It is crucial to upgrade to version 2.1.1 or higher to mitigate this vulnerability. If immediate upgrading is not possible, implementing input validation and filtering techniques can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for merge →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues.
The impact of this vulnerability can be severe, including unauthorized access to sensitive data, code execution, or privilege escalation.
All versions of the 'merge' package prior to version 2.1.1 are affected.
To fix this vulnerability, upgrade the 'merge' package to version 2.1.1 or higher.
Yes, a temporary workaround is to sanitize and validate user-controlled input before passing it to the '_recursiveMerge' function.
References
Related vulnerabilities
Recent vulnerabilities recorded for merge.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
