Julianlamp

Name of the Vulnerable Software and Affected Versions: Nodebb versions prior to 1.18.5 Description: A prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability. Recommendations: For versions prior to 1.18.5, upgrade to version 1.18.5 or later as soon as possible. As a temporary workaround, consider cherry-picking commit hash 1783f918bc19568f421473824461ff2ed7755e4c to receive this patch in lieu of a full upgrade.