Improperly Controlled Modification of Object Prototype Attributes in think-config
Summary
GHSA-6cj2-92m5-7mvp: Improperly Controlled Modification of Object Prototype Attributes. Affects think-config versions < 1.1.3. Fixed in 1.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
think-config is an npm package that is used for configuration management in ThinkJS applications. It allows users to specify attributes to be initialized or updated in an object. However, the package is vulnerable to an issue where it does not properly control modifications of attributes of the object prototype.
Vulnerability Detail
The vulnerability arises when the software receives input from an upstream component that specifies attributes to be initialized or updated in an object. Due to the lack of proper control over modifications of attributes of the object prototype, an attacker can potentially manipulate the prototype chain and introduce unintended behavior or exploit security vulnerabilities. This can lead to various consequences, including unauthorized access, data manipulation, or remote code execution.
How To Fix
Latest published version: 1.1.3 as of 23 Oct 2026
npm install think-config@1.1.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the think-config package is vulnerable to an issue where it does not properly control modifications of attributes of the object prototype. This can potentially lead to unauthorized access, data manipulation, or remote code execution. It is recommended to upgrade to version 1.1.3 or higher of the package to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for think-config →
FAQ
The impact of this vulnerability can vary depending on the specific usage of the think-config package. However, it can potentially lead to unauthorized access, data manipulation, or remote code execution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
There are no known exploits for this vulnerability mentioned in the provided information. However, it is always recommended to promptly apply security patches to mitigate the risk.
You can refer to the Common Weakness Enumeration (CWE) entry for CWE-1321 (https://cwe.mitre.org/data/definitions/1321.html) for more information about this vulnerability.
