GHSA-c4w7-xm78-47vh

Source

https://github.com/advisories/GHSA-c4w7-xm78-47vh

Import Source

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c4w7-xm78-47vh

Aliases

Published

2021-03-29T16:05:12Z

Modified

2023-11-01T05:44:41.829854Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Prototype Pollution in y18n

Details

The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.

const y18n = require('y18n')();

y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.

References

Affected packages

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.2.2

{
    "affected_functions": [
        "(y18n)"
    ]
}

4.0.0

{
    "affected_functions": [
        "(y18n)"
    ]
}

{
    "affected_functions": [
        "(y18n)"
    ]
}