MEDIUM4.2

GHSA-v3r2-3fp4-rp46

Prototype pollution in paypal-adaptive

Details

paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a `__proto__` payload.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/paypal-adaptive

Introduced in: 0

No fixed version published yet for paypal-adaptive (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7643[ADVISORY]
https://github.com/Ideame/paypal-adaptive-sdk-nodejs[PACKAGE]
https://github.com/Ideame/paypal-adaptive-sdk-nodejs/blob/master/lib/paypal-adaptive.js#L31[WEB]
https://snyk.io/vuln/SNYK-JS-PAYPALADAPTIVE-565089[WEB]