CVE-2021-23402: Prototype Pollution in record-like-deep-assign
Summary
CVE-2021-23402: Prototype Pollution in record-like-deep-assign. Affects record-like-deep-assign versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package record-like-deep-assign is an npm package that provides functionality for deep assignment of record-like objects. It allows users to assign values to nested properties of an object in a convenient and efficient manner. However, all versions of this package are vulnerable to Prototype Pollution, which can lead to unexpected behavior and potential security issues.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, allowing them to control or manipulate the behavior of the application. In the case of record-like-deep-assign, this vulnerability can be exploited through its main functionality, potentially leading to unauthorized access, data tampering, or denial of service attacks. The vulnerability has a CVSS score of 7.3, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to update the package to a non-vulnerable version.
Conclusion
The record-like-deep-assign package is vulnerable to Prototype Pollution, which can have serious security implications. It is crucial to update the package to a non-vulnerable version to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for record-like-deep-assign →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to potential security issues.
record-like-deep-assign is an npm package that provides functionality for deep assignment of record-like objects.
This vulnerability can lead to unauthorized access, data tampering, or denial of service attacks in applications that use the record-like-deep-assign package.
The vulnerability has a CVSS score of 7.3, indicating a high severity level.
To fix this vulnerability, update the record-like-deep-assign package to a version beyond 1.0.1.
