Prototype Pollution in mergify
Summary
GHSA-3f95-w5h5-fq86: Prototype Pollution in mergify. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mergify is an npm package that provides functionality for merging multiple objects into one. It is widely used in JavaScript applications for merging configurations, options, and other objects. However, all versions of mergify are vulnerable to Prototype Pollution, a type of vulnerability that allows attackers to modify the prototype of Object, leading to the addition or modification of existing properties that will exist on all objects.
Vulnerability Detail
The vulnerability in mergify arises from the mergify() function, which does not properly sanitize user input. This allows an attacker to inject malicious code that can modify the prototype of Object. By manipulating the prototype, the attacker can add or modify properties that will be present in all objects created afterwards. This can lead to a range of security issues, including remote code execution, data tampering, and privilege escalation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to discontinue the use of mergify and find a suitable replacement.
Conclusion
The mergify package is vulnerable to Prototype Pollution, which can have severe security implications. As there is no fix available and the package is deprecated, it is strongly advised to discontinue its use and switch to a maintained and secure alternative. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mergify →
FAQ
Prototype Pollution is a vulnerability that allows attackers to modify the prototype of Object, leading to the addition or modification of existing properties that will exist on all objects. This can have various security implications.
mergify is an npm package used for merging multiple objects into one. It is commonly used in JavaScript applications for merging configurations, options, and other objects.
The vulnerability in mergify occurs due to improper sanitization of user input in the mergify() function. This allows an attacker to inject malicious code that can modify the prototype of Object.
The potential consequences of this vulnerability include remote code execution, data tampering, and privilege escalation. An attacker could exploit this vulnerability to execute arbitrary code on the affected system or manipulate data in unintended ways.
No, there is currently no fix available for this vulnerability as the package is deprecated. It is recommended to stop using mergify and find an alternative module.
