GHSA-g9cg-h3jm-cwrc Prototype Pollution in @hapi/subtext
- Exploited in the wild
- Not known
- Fix
- Available
What is GHSA-g9cg-h3jm-cwrc?
GHSA-g9cg-h3jm-cwrc is a vulnerability in @hapi/pez, published on 3 Sep 2020.
Official description
Versions of @hapi/pez prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.
Recommendation
Upgrade to versions 5.0.1 or later. There is a fix available for version 4.1.2, but it only available for direct download from the repository.
Which versions are affected by GHSA-g9cg-h3jm-cwrc?
2 open source packages ship an affected version, including @hapi/pez.
| Package | Affected | Fixed in |
|---|---|---|
@hapi/pez npm | All versions | 5.0.1 |
@hapi/pez npm | All versions | 5.0.1 |
How do I fix GHSA-g9cg-h3jm-cwrc?
Upgrade @hapi/pez to 5.0.1 or later.
Is GHSA-g9cg-h3jm-cwrc being exploited?
There is no known exploitation of GHSA-g9cg-h3jm-cwrc in the wild and no public exploit code.