CVE-2020-7748: Prototype pollution in @tsed/core
Summary
CVE-2020-7748: Prototype pollution in @tsed/core. Affects @tsed/core versions < 5.65.7. Fixed in 5.65.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @tsed/core package is an npm package that provides core functionality for the Ts.ED framework. It includes various utilities and functions that are used to enhance the development experience and provide additional features. The package is widely used in TypeScript projects and is an integral part of the Ts.ED ecosystem.
Vulnerability Detail
The vulnerability, identified as CVE-2020-7748, is a prototype pollution vulnerability in the @tsed/core package before version 5.65.7. It specifically affects the deepExtend function in the utils directory. An attacker can exploit this vulnerability by providing user input that can overwrite and pollute the object prototype of a program. This can lead to unexpected behavior, data manipulation, or even remote code execution depending on how the affected program utilizes the polluted object.
How To Fix
Minimum fixed version
5.65.7
This is the first release that contains the fix.
npm install @tsed/core@5.65.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the @tsed/core package to the fixed version as soon as possible.
Conclusion
In conclusion, the @tsed/core package before version 5.65.7 is vulnerable to prototype pollution. This can be exploited by an attacker to manipulate data or execute remote code. To mitigate this risk, it is crucial to update the package to version 5.65.7 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @tsed/core →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior or security issues in the affected program.
An attacker can exploit this vulnerability by providing user input that can overwrite and pollute the object prototype of a program using the deepExtend function in the @tsed/core package.
The consequences of this vulnerability can vary depending on how the affected program utilizes the polluted object. It can lead to unexpected behavior, data manipulation, or even remote code execution.
Yes, the fix for this vulnerability is available in version 5.65.7 of the @tsed/core package. It is recommended to update to this version or later to mitigate the risk.
No, there are no known workarounds for this vulnerability. Updating to the fixed version is the only recommended solution.
