CVE-2021-23397: Prototype Pollution in @ianwalter/merge
Summary
CVE-2021-23397: @ianwalter/merge Prototype Pollution via merge function. Affects @ianwalter/merge versions < 9.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @ianwalter/merge package is an npm package that provides a merge function for combining JavaScript objects. It is used to merge multiple objects into a single object, with the ability to deeply merge nested objects. The package has been deprecated, and the maintainer recommends using @generates/merger instead. However, all versions of @ianwalter/merge are vulnerable to Prototype Pollution through the main merge function.
Vulnerability Detail
The vulnerability in @ianwalter/merge is due to a lack of proper input validation and sanitization. This allows an attacker to modify the prototype of objects during the merge operation, leading to potential Prototype Pollution. Prototype Pollution is a vulnerability that occurs when an attacker can inject or modify properties of an object's prototype, which can result in unexpected behavior or security issues. In the case of @ianwalter/merge, an attacker can manipulate the prototype of merged objects, potentially leading to arbitrary code execution or unauthorized access to sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to follow the recommended fix and switch to @generates/merger or ensure proper input validation and sanitization if continuing to use @ianwalter/merge.
Conclusion
The @ianwalter/merge package is vulnerable to Prototype Pollution, which can lead to unexpected behavior or security issues. It is crucial to take immediate action to fix this vulnerability by switching to @generates/merger or implementing proper input validation and sanitization. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @ianwalter/merge →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can inject or modify properties of an object's prototype, leading to unexpected behavior or security issues.
The impact of this vulnerability can vary depending on the specific usage of @ianwalter/merge. However, it could potentially lead to arbitrary code execution or unauthorized access to sensitive data.
Yes, the maintainer of @ianwalter/merge recommends using @generates/merger as a safer alternative that addresses the Prototype Pollution issue.
Yes, all versions of @ianwalter/merge are vulnerable to Prototype Pollution.
It is recommended to switch to @generates/merger or ensure proper input validation and sanitization if continuing to use @ianwalter/merge.
