CVE-2020-36632: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

December 25, 2022 (updated December 30, 2022)

A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes (‘prototype pollution’). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.

References

github.com/advisories/GHSA-2j2x-2gpw-g8fm
github.com/hughsk/flat/commit/20ef0ef55dfa028caddaedbcb33efbdb04d18e13
github.com/hughsk/flat/issues/105
github.com/hughsk/flat/pull/106
github.com/hughsk/flat/releases/tag/5.0.1
nvd.nist.gov/vuln/detail/CVE-2020-36632
vuldb.com/?ctiid.216777
vuldb.com/?id.216777

Detect and mitigate CVE-2020-36632 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →