Prototype Pollution Vulnerability in UglifyJS: CVE-2022-37598
Summary
DEBIAN-CVE-2022-37598: Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. Affects uglify-js versions 3.12.8-1 – 3.17.4-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
UglifyJS is a widely-used JavaScript parser, minifier, and compressor that helps developers optimize their JavaScript code for better performance. It is known for its ability to reduce file sizes and improve load times by removing unnecessary characters and whitespace. However, a vulnerability has been identified in versions of UglifyJS, specifically affecting the DEFNODE function in ast.js, which could lead to prototype pollution, potentially compromising application security.
Vulnerability Detail
The vulnerability, identified as CVE-2022-37598, originates from a flaw in the DEFNODE function within the ast.js file of UglifyJS version 3.13.2. This flaw allows an attacker to manipulate the 'name' variable, leading to prototype pollution. The ramifications of this vulnerability can be severe, as it may allow attackers to alter the behavior of the application by injecting properties into the Object prototype, which can lead to unexpected behavior or security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the vulnerable features of UglifyJS until you can update to a patched version. Additionally, consider using alternative minification tools that do not have this vulnerability.
Conclusion
The prototype pollution vulnerability in UglifyJS (CVE-2022-37598) poses significant risks to applications using this library. It is crucial for developers to update to the latest version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for uglify-js →
FAQ
CVE-2022-37598 is a prototype pollution vulnerability found in UglifyJS that allows attackers to manipulate the Object prototype through the DEFNODE function in ast.js.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized modification of application behavior, which could lead to security breaches or data corruption.
Yes, updating to the latest version of UglifyJS will provide a patch for this vulnerability.
If you cannot update immediately, consider using alternative minification tools and avoid using the vulnerable features of UglifyJS.
References
Related vulnerabilities
Recent vulnerabilities recorded for uglify-js.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
