CVE-2021-25916: Prototype Pollution Vulnerability in patchmerge

Background

patchmerge is an npm package that provides functionality for merging and patching JavaScript objects. It is commonly used in web development projects to handle object manipulation and data merging tasks. The package is vulnerable to a prototype pollution vulnerability in versions 1.0.0 through 1.0.1. This vulnerability can be exploited by an attacker to cause a denial of service and potentially execute remote code.

Vulnerability Detail

The prototype pollution vulnerability in patchmerge arises from improper handling of user-supplied input. By manipulating the prototype of an object, an attacker can modify the behavior of the application and potentially execute arbitrary code. This can lead to a variety of security issues, including remote code execution and unauthorized access to sensitive data. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.

npm install patchmerge@1.0.2

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by avoiding the use of untrusted user input when using the patchmerge package. It is important to thoroughly validate and sanitize any user-supplied data before passing it to the package's functions. Here is an example of how to sanitize user input in JavaScript:

function sanitizeInput(input) {
  if (typeof input === 'object' && input !== null) {
    return input;
  }
  return {};
}

Conclusion

The prototype pollution vulnerability in patchmerge can have severe consequences, including remote code execution and unauthorized data access. It is crucial to upgrade to the latest version of the package (1.0.2 or later) to mitigate this vulnerability. If immediate upgrading is not possible, developers should implement proper input validation and sanitization to prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for patchmerge →

FAQ