PT-2026-42651 · Npm · @Nevware21/Ts-Utils
Publicado
2026-05-21
·
Atualizado
2026-05-21
CVSS v4.0
7.2
Alta
| Vetor | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
Summary
The copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys ( proto , constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.
Details
In copyProps() (copy.ts lines 186-191), the code iterates all enumerable properties including inherited ones and dangerous keys like proto . Any object with a proto key (e.g., from untrusted JSON input) will overwrite the target's prototype.
PoC
const malicious = JSON.parse('{" proto ": {"polluted": true}}');
objDeepCopy(malicious);
console.log({}.polluted); // trueSuggested Fix
Add objHasOwnProperty check and filter proto , constructor, prototype keys.
Correção
Prototype Pollution
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
@Nevware21/Ts-Utils