Prototype Manipulation Vulnerability in Vega-Util by Vega
CVE-2019-10806

4.3MEDIUM

Key Information:

Vendor

Vega Project

Status
Vega-util
Vendor
CVE Published:
9 March 2020

What is CVE-2019-10806?

Versions of vega-util earlier than 1.13.1 are susceptible to a vulnerability that allows for manipulation of the Object.prototype. This manipulation can occur through the 'vega.mergeConfig' method, which can be exploited to add or modify properties of the prototype, potentially leading to unexpected behavior in applications utilizing this package. Developers should ensure they are using an updated version to mitigate this risk.

Affected Version(s)

vega-util All versions prior to 1.13.1

References

https://snyk.io/vuln/SNYK-JS-VEGAUTIL-559223
x_refsource_MISC
https://github.com/vega/vega/commit/8f33a0b5170d7de4f12fc...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-10806 : Prototype Manipulation Vulnerability in Vega-Util by Vega