CVE-2024-36573: obx Prototype Pollution

June 17, 2024

almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.

References

gist.github.com/mestrtee/fd8181bbc180d775f8367a2b9e0ffcd1
github.com/advisories/GHSA-jj58-488v-4rgf
github.com/llGaetanll/obx
github.com/llGaetanll/obx/commit/984ad92dc06774da4e6bdae0f5f5e59ae80ece8f
nvd.nist.gov/vuln/detail/CVE-2024-36573

Code Behaviors & Features

Detect and mitigate CVE-2024-36573 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →