Описание
Validation Bypass in kind-of
Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.
Recommendation
Upgrade to versions 6.0.3 or later.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2019-20149
- https://github.com/jonschlinkert/kind-of/issues/30
- https://github.com/jonschlinkert/kind-of/pull/31
- https://github.com/jonschlinkert/kind-of/commit/1df992ce6d5a1292048e5fe9c52c5382f941ee0b
- https://snyk.io/vuln/SNYK-JS-KINDOF-537849
- https://www.npmjs.com/advisories/1490
Пакеты
kind-of
>= 6.0.0, < 6.0.3
6.0.3
Связанные уязвимости
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
ctorName in index.js in kind-of v6.0.2 allows external user input to o ...