PT-2022-9397 · Npm · @Generates/Merger+1

Dung Le · Published 2022-07-25 · Updated 2022-08-01 · CVE-2021-23397

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions @ianwalter/merge versions all

Description The issue concerns Prototype Pollution via the main (merge) function. The maintainer suggests using @generates/merger instead, as @ianwalter/merge is deprecated.

Recommendations For all versions, consider using @generates/merger as a replacement, as suggested by the maintainer, until a patch is available for @ianwalter/merge. As a temporary workaround, consider avoiding the use of the merge function in @ianwalter/merge to minimize the risk of exploitation.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-23397

GHSA-42M6-G935-5VMQ

Affected Products

@Generates/Merger

@Ianwalter/Merge

References · 5

• 🔥 https://security.snyk.io/vuln/SNYK-JS-IANWALTERMERGE-1311022 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-23397 · Security Note
• https://osv.dev/vulnerability/GHSA-42m6-g935-5vmq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23397 · Vendor Advisory
• https://github.com/ianwalter/merge · Note