high7.3
CVE-2021-23403
Prototype Pollution in ts-nodash
Impact
`ts-nodash` before version 1.2.7 is vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ts-nodash | < 1.2.7 | 1.2.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ts-Nodash Project | Ts-Nodash | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/BadOPCode/NoDash/blob/master/src/Merge.ts
- https://snyk.io/vuln/SNYK-JS-TSNODASH-1311009
- https://github.com/advisories/GHSA-5xjx-4xcm-hpcm
- https://nvd.nist.gov/vuln/detail/CVE-2021-23403
- https://github.com/BadOPCode/NoDash/commit/b9cc2b3b49f6cd5228e406bc57e17a28b998fea5