GHSA-f7qw-5pvg-mmwp Prototype Pollution in lutils-merge
Prototype pollution in lutils-merge allows attackers to modify object prototypes, potentially causing denial of service or remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-f7qw-5pvg-mmwp?
GHSA-f7qw-5pvg-mmwp is a vulnerability in lutils-merge, published on 13 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of lutils-merge are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.
Recommendation
The package is deprecated and no fixes are available. Consider using an alternative package.
Which versions are affected by GHSA-f7qw-5pvg-mmwp?
2 open source packages ship an affected version, including lutils-merge.
| Package | Affected | Fixed in |
|---|---|---|
lutils-merge npm | All versions to 0.2.6 | None |
lutils-merge npm | All versions to 0.2.6 | None |
How do I fix GHSA-f7qw-5pvg-mmwp?
No fix has been published for GHSA-f7qw-5pvg-mmwp yet. Limit exposure of the affected software until one is available.
Is GHSA-f7qw-5pvg-mmwp being exploited?
There is no known exploitation of GHSA-f7qw-5pvg-mmwp in the wild and no public exploit code.