CVE-2020-7713: Prototype Pollution in arr-flatten-unflatten
Summary
CVE-2020-7713: Prototype Pollution in arr-flatten-unflatten. Affects arr-flatten-unflatten versions < 1.1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The arr-flatten-unflatten package is an npm package that provides functions for flattening and unflattening arrays. It is commonly used in JavaScript applications to manipulate and transform arrays. The package is vulnerable to Prototype Pollution, a type of vulnerability where an attacker can modify the prototype of an object, leading to unexpected behavior or security issues.
Vulnerability Detail
The vulnerability in arr-flatten-unflatten allows an attacker to perform Prototype Pollution via the constructor. By manipulating the constructor, an attacker can inject malicious properties or methods into the prototype chain of objects, potentially leading to remote code execution, information disclosure, or other security compromises. This vulnerability affects all versions of the package up to and including version 1.1.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to a non-vulnerable version as soon as possible.
Conclusion
The arr-flatten-unflatten package is vulnerable to Prototype Pollution via the constructor. It is crucial to update the package to a non-vulnerable version, such as version 1.1.5 or later, to mitigate the risk of remote code execution, information disclosure, or other security compromises. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for arr-flatten-unflatten →
FAQ
Arr-flatten-unflatten is an npm package used for manipulating and transforming arrays in JavaScript applications.
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior or security issues.
The consequences of this vulnerability can include remote code execution, information disclosure, or other security compromises.
All versions of arr-flatten-unflatten up to and including version 1.1.4 are affected by this vulnerability.
To fix this vulnerability, update the arr-flatten-unflatten package to a version that is not affected by the vulnerability, such as version 1.1.5 or later.
