GHSA-36c4-4r89-6whg Prototype Pollution in @commercial/subtext
- Exploited in the wild
- Not known
- Fix
- Available
What is GHSA-36c4-4r89-6whg?
GHSA-36c4-4r89-6whg is a vulnerability in @commercial/subtext, published on 3 Sep 2020.
Official description
Versions of @commercial/subtext prior to 5.1.2 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.
Recommendation
Upgrade to version 5.1.2 or later.
Which versions are affected by GHSA-36c4-4r89-6whg?
2 open source packages ship an affected version, including @commercial/subtext.
| Package | Affected | Fixed in |
|---|---|---|
@commercial/subtext npm | All versions | 5.1.2 |
@commercial/subtext npm | All versions | 5.1.2 |
How do I fix GHSA-36c4-4r89-6whg?
Upgrade @commercial/subtext to 5.1.2 or later.
Is GHSA-36c4-4r89-6whg being exploited?
There is no known exploitation of GHSA-36c4-4r89-6whg in the wild and no public exploit code.