CVE-2019-10805
Exposure of Resource to Wrong Sphere in valib
Résumé
Exposure of Resource to Wrong Sphere in valib
Description d'origine
La description telle que publiée par la source (souvent en anglais).
valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
npm
valib
[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.0.0"}]}]
Références
- advisory nvd.nist.gov
- web snyk.io
- web npmjs.com