Prototype Pollution in @commercial/subtext
Summary
GHSA-36c4-4r89-6whg: Prototype Pollution in @commercial/subtext. Affects @commercial/subtext versions < 5.1.2. Fixed in 5.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @commercial/subtext package is an npm package used for handling multipart payloads. It provides functionality for parsing and processing multipart data in HTTP requests. This package is vulnerable to Prototype Pollution, which is a type of vulnerability that allows an attacker to modify the prototype of an object and inject malicious properties or methods. In this case, a multipart payload can be constructed in a way that allows an attacker to set the entire payload object's prototype. This can lead to bypassing validation rules and potential unauthorized access to data. If the prototype evaluates to null, it can also cause unhandled exceptions when accessing the request payload.
Vulnerability Detail
The vulnerability in @commercial/subtext arises from the improper handling of multipart payloads. By manipulating the payload, an attacker can modify the prototype of the payload object, potentially bypassing validation rules and gaining unauthorized access to data. Additionally, if the prototype evaluates to null, it can cause unhandled exceptions when accessing the request payload. This vulnerability has a high severity rating and is classified under CWE-1321.
How To Fix
Minimum fixed version
5.1.2
This is the first release that contains the fix.
npm install @commercial/subtext@5.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The @commercial/subtext package is vulnerable to Prototype Pollution. It is recommended to upgrade to version 5.1.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @commercial/subtext →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object and inject malicious properties or methods. It can lead to bypassing validation rules and unauthorized access to data.
This vulnerability in @commercial/subtext allows an attacker to manipulate multipart payloads and modify the prototype of the payload object. This can potentially bypass validation rules and result in unauthorized access to data.
This vulnerability has a high severity rating.
This vulnerability is classified under CWE-1321.
To fix this vulnerability, upgrade to version 5.1.2 or later of the @commercial/subtext package.
References
Related vulnerabilities
Recent vulnerabilities recorded for @commercial/subtext.
