Prototype Pollution in json-logic-js
Summary
GHSA-m9hw-7xfv-wqg7: Prototype Pollution in json-logic-js. Affects json-logic-js versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The json-logic-js package is an open-source library that provides a lightweight and efficient way to evaluate JSON-like data structures. It allows users to define rules and execute them against data objects. The package is commonly used in web applications to implement dynamic logic and decision-making processes. However, versions prior to 2.0.0 of json-logic-js are vulnerable to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object. In the case of json-logic-js, the 'method' operation allows a malicious user to modify the prototype of the 'Object' through the 'method' property name. This modification can lead to the alteration of existing properties on all objects, potentially resulting in remote code execution. An example rule that exploits this vulnerability is provided, which creates a popup when executed in a browser.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
npm install json-logic-js@2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible.
Conclusion
The json-logic-js package prior to version 2.0.0 is vulnerable to Prototype Pollution, which can lead to remote code execution. It is crucial for developers to update to the fixed version of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for json-logic-js →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to the alteration of existing properties and potential code execution.
The vulnerability in json-logic-js arises from the 'method' operation, which allows the modification of the prototype of the 'Object' through the 'method' property name.
The consequences of this vulnerability include the ability for an attacker to modify existing properties on all objects, potentially leading to remote code execution.
Yes, updating the json-logic-js package to version 2.0.0 or later fixes the Prototype Pollution issue.
No, there are no known workarounds for this vulnerability. Updating to the fixed version of the package is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for json-logic-js.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
