CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

References

Affected packages

Git / github.com/jonschlinkert/kind-of

Affected ranges

Type: GIT
Repo: https://github.com/jonschlinkert/kind-of
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

0b4ababf3a8505f60055487415a2dfe678a10b53

Affected versions

0.*

0.1.0

0.1.2

0.3.0

1.*

1.0.0

1.1.0

2.*

2.0.0

2.0.1

3.*

3.0.0

3.0.3

3.0.4

3.1.0

3.2.0

3.2.1

3.2.2

4.*

4.0.0

5.*

5.0.0

5.0.1

5.0.2

5.1.0

6.*

6.0.1

6.0.2

v0.*

v0.1.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-20149.json"