GHSA-jg8v-48h5-wgxg

jszip Vulnerable to Prototype Pollution

En bref

Publiée: 2021-08-10 16:02 UTC
Mise à jour: 2025-01-14 09:12 UTC
CVE: CVE-2021-23413
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g `__proto__`, `toString`, etc) results in a returned object with a modified prototype instance.

Paquets affectés

Paquet	Versions
npm · jszip	introduced 3.0.0, fixed 3.7.0
npm · jszip	introduced 0, fixed 2.7.0

Références

https://nvd.nist.gov/vuln/detail/CVE-2021-23413 ADVISORY
https://github.com/Stuk/jszip/pull/766 WEB
https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b36 WEB
https://github.com/Stuk/jszip PACKAGE
https://github.com/Stuk/jszip/blob/master/lib/object.js%23L88 WEB
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1251499 WEB
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1251498 WEB
https://snyk.io/vuln/SNYK-JS-JSZIP-1251497 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database