Description
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ntharim | dot-access | ≤ 1.0.0 | — |
References
- https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2 third-party-advisory
- https://github.com/ntharim/dot-access/issues/5 issue-tracking
- https://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L9-L18 technical-description
- https://github.com/ntharim/dot-access product
- VulnCheck Advisory: dot-access through 1.0.0 Prototype Pollution via set() path argument third-party-advisory