CVE-2024-32866 Conform contains Prototype Pollution Vulnerability in `parseWith...` function
Prototype pollution in Conform allows attackers to manipulate object prototypes via crafted inputs, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32866?
CVE-2024-32866 is a high-severity vulnerability in edmundhung conform, published on 23 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.
Weakness: CWE-1321
Which versions are affected by CVE-2024-32866?
12 open source packages ship an affected version, including @conform-to/dom, @conform-to/yup and @conform-to/zod.
| Package | Affected | Fixed in |
|---|---|---|
@conform-to/dom npm | All versions | 0.9.2 |
@conform-to/dom npm | All versions | 0.9.2 |
@conform-to/dom npm | From 1.0.0 | 1.1.1 |
@conform-to/dom npm | From 1.0.0 | 1.1.1 |
@conform-to/yup npm | All versions | 0.9.2 |
@conform-to/yup npm | All versions | 0.9.2 |
6 more packages
@conform-to/yup npm | From 1.0.0 | 1.1.1 |
@conform-to/yup npm | From 1.0.0 | 1.1.1 |
@conform-to/zod npm | All versions | 0.9.2 |
@conform-to/zod npm | All versions | 0.9.2 |
@conform-to/zod npm | From 1.0.0 | 1.1.1 |
@conform-to/zod npm | From 1.0.0 | 1.1.1 |
How do I fix CVE-2024-32866?
Upgrade @conform-to/dom to a fixed version for your release line: 0.9.2 or 1.1.1.
Is CVE-2024-32866 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32866 exists.
Sources
Also known as GHSA-624g-8qjg-8qxf.