CVE-2024-24294: Blackprint @blackprint/engine Prototype Pollution issue

May 20, 2024

A Prototype Pollution issue in Blackprint @blackprint/engine 0.8.12 through 0.9.1 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.

References

gist.github.com/mestrtee/d1eb6e1f7c6dd60d8838c3e56cab634d
github.com/Blackprint/engine-js
github.com/Blackprint/engine-js/commit/bd6b965b03c467e7a58ab0cb89b9172fa5e07013
github.com/advisories/GHSA-g3q2-vcjq-rgrc
nvd.nist.gov/vuln/detail/CVE-2024-24294

Code Behaviors & Features

Detect and mitigate CVE-2024-24294 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →