CVE-2020-7771: Prototype Pollution in asciitable.js
Summary
CVE-2020-7771: Prototype Pollution in asciitable.js. Affects asciitable.js versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
asciitable.js is an npm package that provides functionality for generating ASCII tables in JavaScript. It is commonly used in applications that require the display of tabular data in a text-based format. The package allows developers to easily create and customize ASCII tables with various formatting options. However, versions prior to 1.0.3 are vulnerable to Prototype Pollution, a critical security issue that can lead to remote code execution and other malicious activities.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, allowing them to inject or modify properties and methods. In the case of asciitable.js, the main function is susceptible to Prototype Pollution. An attacker can craft a malicious payload that, when processed by the vulnerable function, can modify the prototype of objects used internally by the package. This can lead to unexpected behavior, including the execution of arbitrary code. The impact of this vulnerability depends on how the affected package is used within an application, but it has the potential to compromise the integrity and security of the system.
How To Fix
Minimum fixed version
1.0.3
This is the first release that contains the fix.
npm install asciitable.js@1.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible.
Conclusion
The asciitable.js package before version 1.0.3 is vulnerable to Prototype Pollution, a critical security issue that can lead to remote code execution and other malicious activities. To mitigate this vulnerability, it is crucial to update to version 1.0.3 or later of the package. There are no known workarounds for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for asciitable.js →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, enabling them to inject or modify properties and methods.
The impact of this vulnerability depends on how the affected package is used within an application. It has the potential to lead to remote code execution, data manipulation, and other malicious activities.
Yes, upgrading to version 1.0.3 or later of asciitable.js fixes the Prototype Pollution issue.
No, there are no known workarounds. It is essential to update to the fixed version of the package.
You can update the package by running the command 'npm install asciitable.js@1.0.3' in your project directory.
