HIGH8.8

GHSA-9534-h433-2rjf

Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify

Quick fix

GHSA-9534-h433-2rjf — utilitify: upgrade to the fixed version with the command below.

npm install utilitify@1.0.3

Details

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/utilitify

Introduced in: 0Fixed in: 1.0.3

Fixnpm install utilitify@1.0.3

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10808[ADVISORY]
https://github.com/xcritical-software/utilitify/commit/88d6e27009823338bf319ffb768fe6b08e8ad2d1,[WEB]
https://snyk.io/vuln/SNYK-JS-UTILITIFY-559497[WEB]