CVE-2021-23395: Prototype Pollution in nedb
Summary
CVE-2021-23395: Prototype Pollution in nedb. Affects nedb versions < 1.8.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nedb is an npm package that provides a lightweight embedded database for Node.js applications. It is designed to be easy to use and offers a simple API for data storage and retrieval. However, all versions of nedb are vulnerable to a prototype pollution issue. This vulnerability allows an attacker to manipulate the properties of Object.prototype using a proto or constructor.prototype payload.
Vulnerability Detail
The prototype pollution vulnerability in nedb can have serious consequences. By modifying the properties of Object.prototype, an attacker can potentially alter the behavior of the entire application. This could lead to various security issues, such as remote code execution, information disclosure, or denial of service attacks. The vulnerability affects all versions of nedb up to and including 1.8.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The prototype pollution vulnerability in nedb can have serious consequences for applications using this package. It is crucial to update nedb to a version that includes a fix for this vulnerability to ensure the security and integrity of the application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nedb →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker is able to modify the prototype of an object. By manipulating the prototype, the attacker can introduce malicious properties or modify existing ones, leading to unexpected behavior in the application.
An attacker can exploit this vulnerability by crafting a payload that manipulates the proto or constructor.prototype property. By injecting malicious properties into Object.prototype, the attacker can potentially execute arbitrary code or disrupt the normal behavior of the application.
The recommended mitigation for this vulnerability is to update nedb to a version that includes a fix for the issue. It is also important to regularly update all dependencies to ensure that known vulnerabilities are addressed.
Yes, this vulnerability has been assigned the CVE identifier CVE-2021-23395.
There is no evidence of active exploitation of this vulnerability at the moment. However, it is important to patch the vulnerability as soon as possible to prevent any potential attacks.
