HIGH7.5

GHSA-ph28-wwfj-fv7f

Prototype Pollution in sds

Details

This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to CVE-2020-7618

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/sds

Introduced in: 0

No fixed version published yet for sds (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7618[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2022-25862[ADVISORY]
https://github.com/monsterkodi/sds[PACKAGE]
https://github.com/monsterkodi/sds/blob/master/js/set.js[WEB]
https://snyk.io/vuln/SNYK-JS-SDS-2385944[WEB]