Опубликовано: 04 апр. 2025
Источник: github
Github: Прошло ревью
CVSS4: 5.5
CVSS3: 7.3
Описание
expand-object Vulnerable to Prototype Pollution via the expand() Function
Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto.
Пакеты
Наименование
expand-object
npm
Затронутые версииВерсия исправления
<= 0.4.2
Отсутствует
Связанные уязвимости
CVSS3: 7.3
nvd
10 месяцев назад
Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.