CVE-2022-25352: Prototype Pollution in libnested

March 17, 2022 (updated March 24, 2022)

The package libnested before 1.5.2 is vulnerable to Prototype Pollution via the set function in index.js. Note: This vulnerability derives from an incomplete fix for CVE-2020-28283

References

github.com/advisories/GHSA-x5m8-2r8v-8f97
github.com/dominictarr/libnested/blob/master/index.js%23L22
github.com/dominictarr/libnested/commit/c1129865d75fbe52b5a4f755ad3110ca5420f2e1
nvd.nist.gov/vuln/detail/CVE-2022-25352
snyk.io/vuln/SNYK-JS-LIBNESTED-2342117

Code Behaviors & Features

Detect and mitigate CVE-2022-25352 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →