Описание
Hono before 4.12.7 allows proto key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with proto properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.
EPSS
Процентиль: 19%
0.00273
Низкий
4.8 Medium
CVSS3
Дефекты
CWE-1321
Связанные уязвимости
CVSS3: 4.8
github
около 2 месяцев назад
Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.
EPSS
Процентиль: 19%
0.00273
Низкий
4.8 Medium
CVSS3
Дефекты
CWE-1321