CVE-2022-24279: Prototype Pollution in madlib-object-utils
Summary
CVE-2022-24279: Prototype Pollution in madlib-object-utils. Affects madlib-object-utils versions < 0.1.8. Fixed in 0.1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
madlib-object-utils is an npm package that provides utility functions for working with JavaScript objects. It is commonly used in web development projects to manipulate and modify object data. However, versions before 0.1.8 of madlib-object-utils are vulnerable to Prototype Pollution. This vulnerability allows an attacker to merge object prototypes into the package, potentially leading to unauthorized access, data manipulation, or code execution.
Vulnerability Detail
The vulnerability in madlib-object-utils arises from the setValue method, which does not properly sanitize user input. This allows an attacker to inject malicious properties into the object, leading to Prototype Pollution. By manipulating the object's prototype chain, an attacker can modify or override existing properties, introduce new properties, or execute arbitrary code. This can have severe consequences, such as unauthorized data access, privilege escalation, or remote code execution.
How To Fix
Latest published version: 0.1.8 as of 23 Oct 2026
npm install madlib-object-utils@0.1.8The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to validate and sanitize user input before passing it to the setValue method. This can be done by implementing input validation and using safe object manipulation techniques. Here's an example of how to sanitize user input using the madlib-object-utils package:
const { sanitizeInput } = require('madlib-object-utils');
const userInput = req.body;
const sanitizedInput = sanitizeInput(userInput);
// Use the sanitized input in the setValue method
setValue(sanitizedInput);
Conclusion
In conclusion, madlib-object-utils versions before 0.1.8 are vulnerable to Prototype Pollution. This can lead to unauthorized data access, privilege escalation, or remote code execution. It is crucial to upgrade to version 0.1.8 or later to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for madlib-object-utils →
FAQ
Prototype Pollution is a vulnerability that occurs when an application allows user-controlled input to modify the prototype of an object. This can lead to unintended modifications of existing properties, introduction of new properties, or even code execution.
The impact of this vulnerability can be severe. An attacker can manipulate the object's prototype chain, leading to unauthorized data access, privilege escalation, or remote code execution. This can result in data breaches, system compromise, or unauthorized actions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any known vulnerabilities, including CVE-2022-24279.
Yes, a fix is available for this vulnerability. It is recommended to upgrade to version 0.1.8 or later of madlib-object-utils. This version includes a complete fix for the Prototype Pollution issue.
If upgrading to the latest version is not immediately feasible, you can implement input validation and sanitization to mitigate the risk. Ensure that user-controlled input is properly validated and sanitized before passing it to the vulnerable method.
References
Related vulnerabilities
Recent vulnerabilities recorded for madlib-object-utils.
