CVE-2021-25914: Prototype Pollution Vulnerability in object-collider
Summary
CVE-2021-25914: Prototype Pollution Vulnerability in object-collider. Affects object-collider versions >= 1.0.0, < 1.0.4. Fixed in 1.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'object-collider' package is an npm package that provides functionality for object collision detection. It allows developers to detect collisions between objects in JavaScript applications. The package is widely used in various projects and versions 1.0.0 through 1.0.3 are affected by a prototype pollution vulnerability.
Vulnerability Detail
The prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows an attacker to cause a denial of service and may lead to remote code execution. This vulnerability arises from improper handling of user-supplied input, which can result in the modification of the prototype of an object. By manipulating the prototype, an attacker can potentially execute arbitrary code or disrupt the normal functionality of the application.
How To Fix
Minimum fixed version
1.0.4
This is the first release that contains the fix.
npm install object-collider@1.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The 'object-collider' package versions 1.0.0 through 1.0.3 are vulnerable to a prototype pollution issue that can lead to a denial of service and potential remote code execution. It is crucial to upgrade to version 1.0.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for object-collider →
FAQ
The vulnerability can lead to a denial of service and potentially allow remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities.
No, only versions 1.0.0 through 1.0.3 are affected. Version 1.0.4 and later include a fix for the vulnerability.
Currently, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the package.
You can find more information about this vulnerability in the GitHub Security Advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-85g2-29m8-qf2p/GHSA-85g2-29m8-qf2p.json
