MEDIUM5.3

GHSA-prv2-xwr7-hr57

Uncontrolled Resource Consumption in rdf-graph-array

Details

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/rdf-graph-array

Introduced in: 0

No fixed version published yet for rdf-graph-array (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10798[ADVISORY]
https://github.com/rdf-ext-archive/rdf-graph-array/blob/master/index.js#L211[WEB]
https://snyk.io/vuln/SNYK-JS-RDFGRAPHARRAY-551803[WEB]