PT-2020-9145 · Unknown · Component-Flatten

Published 2020-02-18 · Updated 2022-05-24 · CVE-2019-10794

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions component-flatten versions all

Description The issue allows the a function to be tricked into adding or modifying properties of Object.prototype using a proto payload, which is a form of Prototype Pollution. This occurs because the function does not properly handle the proto property in the payload.

Recommendations For all versions, consider restricting the use of the a function until a patch is available to prevent potential exploitation. As a temporary workaround, avoid using the proto property in the payload to minimize the risk of Prototype Pollution.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2019-10794

GHSA-G6R3-HHG9-QF58

Affected Products

Component-Flatten

References · 4

• https://snyk.io/vuln/SNYK-JS-COMPONENTFLATTEN-548907 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-10794 · Security Note
• https://osv.dev/vulnerability/GHSA-g6r3-hhg9-qf58 · Vendor Advisory
• https://github.com/componentjs/flatten.js · Note