critical9.1
CVE-2021-41097
Prototype pollution in aurelia-path
Impact
### Impact The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf` ### Patches The problem should be patched in version `1.1.7`. Any version earlier than this is vulnerable. ### Workarounds A partial work around is to free the Object prototype: ```ts Object.freeze(Object.prototype) ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | aurelia-path | < 1.1.7 | 1.1.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bluespire | Aurelia-Path | before 1.1.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1
- https://github.com/aurelia/path/issues/44
- https://github.com/aurelia/path/releases/tag/1.1.7
- https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv
- https://www.npmjs.com/package/aurelia-path
- https://github.com/advisories/GHSA-3c9c-2p65-qvwv
- https://nvd.nist.gov/vuln/detail/CVE-2021-41097