GHSA-c3px-v9c7-m734 Prototype Pollution in mithril
Prototype pollution in mithril allows attackers to modify Object prototypes via query strings, potentially leading to code execution or logic bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-c3px-v9c7-m734?
GHSA-c3px-v9c7-m734 is a vulnerability in mithril, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of mithrilare vulnerable to prototype pollution. The function parseQueryString may allow a malicious user to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. A payload such as __proto__%5BtoString%5D=123 in the query string would change the toString() function to 123.
Recommendation
If you are using mithril 2.x, upgrade to version 2.0.2 or later. If you are using mithril 1.x, upgrade to version 1.1.7 or later.
Which versions are affected by GHSA-c3px-v9c7-m734?
4 open source packages ship an affected version, including mithril.
| Package | Affected | Fixed in |
|---|---|---|
mithril npm | All versions | 1.1.7 |
mithril npm | All versions | 1.1.7 |
mithril npm | From 2.0.0 | 2.0.2 |
mithril npm | From 2.0.0 | 2.0.2 |
How do I fix GHSA-c3px-v9c7-m734?
Upgrade mithril to a fixed version for your release line: 1.1.7 or 2.0.2.
Is GHSA-c3px-v9c7-m734 being exploited?
There is no known exploitation of GHSA-c3px-v9c7-m734 in the wild and no public exploit code.