CVE-2019-10795: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

February 9, 2022

undefsafe is vulnerable to Prototype Pollution. The ‘a’ function could be tricked into adding or modifying properties of Object.prototype using a proto payload.

References

github.com/advisories/GHSA-332q-7ff2-57h2
github.com/remy/undefsafe/commit/f272681b3a50e2c4cbb6a8533795e1453382c822
nvd.nist.gov/vuln/detail/CVE-2019-10795
snyk.io/vuln/SNYK-JS-UNDEFSAFE-548940

Code Behaviors & Features

Detect and mitigate CVE-2019-10795 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →