CVE-2019-10805
Exposure of Resource to Wrong Sphere in valib
Summary
Exposure of Resource to Wrong Sphere in valib
Original description
The description as published by the source.
valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
npm
valib
[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.0.0"}]}]
References
- advisory nvd.nist.gov
- web snyk.io
- web npmjs.com