Prototype Pollution Vulnerability in y18n Package
Summary
CVE-2020-7774: The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. Affects nodejs versions < 10.24.1-r0. Fixed in 10.24.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The y18n package is a localization library for Node.js applications. It provides a simple way to manage and translate messages in different languages. However, versions before 3.2.2, 4.0.1, and 5.0.5 of y18n are vulnerable to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object. In the case of y18n, an attacker can manipulate the prototype of the y18n.__n function, leading to potential code execution or denial of service attacks. This vulnerability can be exploited by passing specially crafted language files to the y18n library.
How To Fix
Minimum fixed version
10.24.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is crucial to update the y18n package to the fixed versions as soon as possible.
Conclusion
The y18n package is vulnerable to Prototype Pollution, which can lead to code execution or denial of service attacks. It is crucial to update the package to versions 3.2.2, 4.0.1, or 5.0.5 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior or code execution.
The y18n package can be exploited by passing specially crafted language files to the library, which can manipulate the prototype of the y18n.__n function.
This vulnerability can lead to code execution or denial of service attacks, depending on how it is exploited.
No, only versions before 3.2.2, 4.0.1, and 5.0.5 of y18n are vulnerable to this issue.
You can update the y18n package by running the command npm install y18n@latest.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
