CVE-2022-25948: liquidjs may leak properties of a prototype
(updated )
The package liquidjs before 10.0.0 is vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.
References
- github.com/advisories/GHSA-45rm-2893-5f49
- github.com/harttle/liquidjs
- github.com/harttle/liquidjs/commit/7e99efc5131e20cf3f59e1fc2c371a15aa4109db
- github.com/harttle/liquidjs/commit/7eb621601c2b05d6e379e5ce42219f2b1f556208
- github.com/harttle/liquidjs/issues/454
- groups.google.com/u/0/a/snyk.io/g/report/c/9ipXecWRtTM/m/IgLadevtCQAJ
- nvd.nist.gov/vuln/detail/CVE-2022-25948
- security.snyk.io/vuln/SNYK-JS-LIQUIDJS-2952868
Code Behaviors & Features
Detect and mitigate CVE-2022-25948 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →