Описание
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.
A prototype pollution vulnerability was found in Linkify. This vulnerability allows an attacker to inject HTML attributes and manipulate user-controlled variables.
Отчет
No Red Hat products or offerings are affected by this vulnerability. This vulnerability is Important rather than Moderate because it enables a direct escalation from a logic flaw (prototype pollution) to active client-side code execution (XSS) in a single step, with no complex exploitation required. By failing to filter the proto property in the assign() helper, Linkify.js 4.3.1 allows attackers to inject malicious event handlers into Object.prototype, which are then automatically inherited and applied to all generated elements. This results in universal HTML attribute injection, enabling both stored and reflected XSS. Since Linkify is commonly used in contexts that render untrusted user input—such as comments, chat messages, and CMS content—this flaw can be exploited remotely and at scale, impacting every end-user who views the processed content.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Serverless | openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 | Not affected | ||
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Not affected | ||
| Red Hat Developer Hub | rhdh/rhdh-rhel9-operator | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.6 High
CVSS3
Связанные уязвимости
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)
EPSS
8.6 High
CVSS3