MEDIUM6.3

GHSA-8h84-8j4f-p97q

Injection in bodymen

Quick fix

GHSA-8h84-8j4f-p97q — bodymen: upgrade to the fixed version with the command below.

npm install bodymen@1.1.1

Details

bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/bodymen

Introduced in: 0Fixed in: 1.1.1

Fixnpm install bodymen@1.1.1

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10792[ADVISORY]
https://github.com/diegohaz/bodymen/commit/5d52e8cf360410ee697afd90937e6042c3a8653b[WEB]
https://snyk.io/vuln/SNYK-JS-BODYMEN-548897[WEB]