high7.5
CVE-2019-10805
Exposure of Resource to Wrong Sphere in valib
Impact
valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | valib | <= 2.0.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sideralis | Valib.Js | through 2.0.0 |