CVE-2020-7765 Prototype Pollution
An attacker can pollute the object prototype via the deepExtend function, potentially leading to code execution or security bypasses in applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7765?
CVE-2020-7765 is a medium-severity vulnerability in @firebase/util, published on 16 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Which versions are affected by CVE-2020-7765?
2 open source packages ship an affected version, including @firebase/util. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@firebase/util npm | All versions | 0.3.4 |
@firebase/util npm | All versions | 0.3.4 |
Products include Google Firebase\/Util.
How do I fix CVE-2020-7765?
Upgrade @firebase/util to 0.3.4 or later.
Is CVE-2020-7765 being exploited?
There is no known exploitation of CVE-2020-7765 in the wild and no public exploit code.
Sources
Also known as GHSA-fpm5-vv97-jfwg, SNYK-JS-FIREBASEUTIL-1038324.