CVE-2021-3645: Prototype Pollution in @viking04/merge
Summary
CVE-2021-3645: merge vulnerable to Prototype Pollution. Affects @viking04/merge versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @viking04/merge package is an npm package that provides a merge function for combining multiple objects into one. It is commonly used in JavaScript applications to merge configuration objects or merge data from different sources. The package is vulnerable to a type of security issue known as Prototype Pollution, which allows an attacker to modify the prototype of an object and potentially execute arbitrary code or cause unintended behavior.
Vulnerability Detail
The vulnerability in @viking04/merge arises from improper control over the modification of object prototype attributes, leading to Prototype Pollution. This vulnerability can be exploited by an attacker to modify the behavior of the merge function or introduce malicious code into the merged objects. The impact of this vulnerability can range from unauthorized data access to remote code execution, depending on how the merged objects are used in the application. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
npm install @viking04/merge@1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update the @viking04/merge package, a possible workaround is to avoid using the merge function with untrusted or user-controlled data. Instead, consider using alternative methods or libraries that are not affected by the Prototype Pollution vulnerability. Here is an example of how you can use the lodash library to achieve a similar merging functionality:
const mergedObject = _.merge({}, object1, object2);
Conclusion
The @viking04/merge package is vulnerable to Prototype Pollution, which can lead to unauthorized data access, remote code execution, or unintended behavior. To mitigate this vulnerability, it is recommended to update the package to version 1.0.2 or later. If immediate update is not possible, exercise caution when using the merge function with untrusted or user-controlled data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @viking04/merge →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, allowing them to control or modify the behavior of the object and potentially execute arbitrary code.
The @viking04/merge package can be exploited by passing malicious or specially crafted objects to the merge function, which can lead to the modification of the object's prototype and the execution of arbitrary code.
The consequences of this vulnerability can vary depending on how the merged objects are used in the application. Possible consequences include unauthorized data access, remote code execution, or unintended behavior due to the modified object prototypes.
Yes, a fix for this vulnerability is available in version 1.0.2 of the @viking04/merge package. It is recommended to update to this version or later to mitigate the risk.
If immediate update is not possible, a workaround is to avoid using the merge function with untrusted or user-controlled data. Consider using alternative methods or libraries that are not affected by the Prototype Pollution vulnerability.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
