PT-2019-20047 · Upmerge · Upmerge

Published 2019-06-06 · Updated 2019-06-06

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions upmerge versions (affected versions not specified)

Description The issue concerns a Prototype Pollution problem. The merge() function fails to prevent user input from altering an Object's prototype, allowing attackers to modify or override properties of all objects in the application. This could lead to Denial of Service or potentially be chained with other issues to achieve Remote Code Execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Consider using an alternative module until a fix is made available. As a temporary workaround, consider disabling the merge() function until a patch is available.

Insufficient Verification of Data Authenticity

Resource Exhaustion

Weakness Enumeration

CWE-345

CWE-400

Related Identifiers

GHSA-GM9G-2G8V-FVXJ

Affected Products

Upmerge

References · 5

• https://osv.dev/vulnerability/GHSA-gm9g-2g8v-fvxj · Vendor Advisory
• https://npmjs.com/advisories/809 · Note
• https://github.com/jazzfog/UpMerge · Note
• https://hackerone.com/reports/439120 · Note
• https://snyk.io/vuln/SNYK-JS-UPMERGE-174133 · Note