CVE-2021-23470: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

February 4, 2022 (updated February 9, 2022)

This affects the package putil-merge The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077

References

github.com/panates/putil-merge/commit/476d00078dfb2827d7c9ee0f2392c81b864f7bc5
nvd.nist.gov/vuln/detail/CVE-2021-23470
snyk.io/vuln/SNYK-JS-PUTILMERGE-2391487

Code Behaviors & Features

Detect and mitigate CVE-2021-23470 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →