Prototype Pollution Vulnerability in Merge Package by VisionMedia
CVE-2018-16469

7.5HIGH

Key Information:

Vendor

Hackerone

Status
Merge
Vendor
CVE Published:
30 October 2018

What is CVE-2018-16469?

The merge package versions prior to 1.2.1 contain a vulnerability in the merge.recursive function that can be exploited to manipulate the Object prototype. This manipulation allows attackers to add or modify properties on the Object prototype, which can subsequently affect all objects within the application. If exploited, this could lead to a Denial of Service attack, compromising the application's reliability and stability.

Affected Version(s)

merge <1.2.1

References

https://hackerone.com/reports/381194
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.