CVE-2021-23421: Prototype Pollution in merge-change
Summary
CVE-2021-23421: Prototype Pollution in merge-change. Affects merge-change versions < 1.8.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is merge-change, an npm package. It is used for merging changes between two objects in JavaScript. The package provides a set of utility functions, including the 'utils.set' function. This function is vulnerable to Prototype Pollution, a vulnerability that allows an attacker to modify the prototype of an object and potentially execute arbitrary code.
Vulnerability Detail
The vulnerability in merge-change arises from the 'utils.set' function, which does not properly sanitize user input. An attacker can exploit this by injecting malicious data that pollutes the prototype of an object. This can lead to various consequences, such as remote code execution, privilege escalation, or denial of service attacks. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can avoid using the 'utils.set' function or implement input validation and sanitization before using it. Here is an example of how to sanitize user input using the 'merge-change' package:
const mergeChange = require('merge-change');
function sanitizeInput(input) {
// Perform input validation and sanitization
// ...
return input;
}
const sanitizedInput = sanitizeInput(userInput);
mergeChange.utils.set(targetObject, sanitizedInput);
Conclusion
In conclusion, the merge-change package is vulnerable to Prototype Pollution via the 'utils.set' function. This vulnerability can have severe consequences, including remote code execution. It is crucial to update the package to the latest version and follow best practices for input validation and sanitization. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for merge-change →
FAQ
Merge-change is an npm package used for merging changes between two objects in JavaScript.
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object and potentially execute arbitrary code.
The impact of this vulnerability can range from remote code execution to privilege escalation or denial of service attacks.
To fix this vulnerability, update the merge-change package to the latest version that includes a patch for this issue.
As a temporary workaround, avoid using the 'utils.set' function or implement input validation and sanitization before using it.
