CVE-2022-25645: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

May 3, 2022 (updated May 20, 2022)

All versions of package dset is vulnerable to Prototype Pollution via ‘dset/merge’ mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

References

github.com/advisories/GHSA-23wx-cgxq-vpwx
github.com/lukeed/dset/blob/master/src/merge.js%23L9
nvd.nist.gov/vuln/detail/CVE-2022-25645
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2431974
snyk.io/vuln/SNYK-JS-DSET-2330881

Code Behaviors & Features

Detect and mitigate CVE-2022-25645 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →