CVE-2022-23631 Prototype Pollution leading to Remote Code Execution in superjson
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2022-23631?
CVE-2022-23631 is a critical vulnerability in blitz-js superjson, published on 9 Feb 2022.
Official description
superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. This has been patched in superjson 1.8.1. Users are advised to update. There are no known workarounds for this issue.
Which versions are affected by CVE-2022-23631?
4 open source packages ship an affected version, including superjson and blitz. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
superjson npm | All versions | 1.8.1 |
superjson npm | All versions | 1.8.1 |
blitz npm | All versions | 0.45.3 |
blitz npm | All versions | 0.45.3 |
Products include Blitzjs Blitz, Blitzjs Superjson.
How do I fix CVE-2022-23631?
Upgrade superjson to 1.8.1 or later.
Is CVE-2022-23631 being exploited?
There is no known exploitation of CVE-2022-23631 in the wild and no public exploit code.
Sources
Also known as GHSA-5888-ffcr-r425.