Skip to content

high Prototype Pollution in protobufjs #32

Description

@sbanoseg

Module: protobufjs
Installed version: 6.11.2
Published: 28/05/2022, 02:00:20
CWE-1321
GHSA-g954-5hwp-pp24
Vulnerable: <6.11.3
Patched: >=6.11.3
Overview
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.

This vulnerability can occur in multiple ways:

by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions
by parsing/loading .proto files
Remediation
Upgrade to version 6.11.3 or later

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions