CVE-2020-7727: Prototype Pollution in gedi
Summary
CVE-2020-7727: Prototype Pollution in gedi. Affects gedi versions < 1.6.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gedi is an npm package that provides functionality for manipulating and accessing JavaScript objects. It is widely used in various applications and projects. However, versions up to and including 1.6.3 of gedi are vulnerable to Prototype Pollution via the set function.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior and potential security issues. In the case of gedi, the set function is susceptible to Prototype Pollution, allowing an attacker to modify the prototype of an object and potentially execute arbitrary code or manipulate data. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can manually validate and sanitize input before using the set function in gedi. This can be done by checking the type and structure of the input object, ensuring that only trusted and expected properties are modified.
Conclusion
In conclusion, gedi versions up to and including 1.6.3 are vulnerable to Prototype Pollution via the set function. It is crucial to upgrade to a version higher than 1.6.3 to mitigate this vulnerability. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gedi →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues.
The gedi package becomes vulnerable to Prototype Pollution due to inadequate input validation and sanitization in the set function, allowing an attacker to modify the prototype of an object.
This vulnerability can allow an attacker to execute arbitrary code, manipulate data, or perform unauthorized actions within the affected application or system.
Yes, the maintainers of gedi have addressed this vulnerability in versions higher than 1.6.3 by implementing proper input validation and sanitization to prevent Prototype Pollution attacks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using package-lock.json without requiring access to the code or installation.
