Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A prototype pollution vulnerability exists in the latest version of the convict npm package (6.2.4). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. Details The vulnerability resides in line 564 of https://github.com/mozilla/node-convict/blob/master/packages/convict/src/main.js where startsWith() function is used to check whether user provided input contain forbidden strings. PoC Steps to reproduce 1. Install latest version of convict using npm install or cloning from git 2. Run the following code snippet: Expected behavior Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console: Actual behavior Object.prototype is polluted This is printed on the console: Impact This is a prototype pollution vulnerability, which can have severe security…
Recommended action: Upgrade to 6.2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Two unguarded prototype pollution paths exist, not covered by previous fixes: 1. config.load() / config.loadFile() — overlay() recursively merges config data without checking for forbidden keys. Input containing proto or constructor.prototype (e.g. from a JSON file) causes the recursion to reach Object.prototype and write attacker-controlled values onto it. 2. Schema initialization — passing a schema with constructor.prototype. keys to convict({...}) causes default-value propagation to write directly to Object.prototype at startup. Depending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE. Workarounds Do not pass untrusted data to load(), loadFile(), or convict(). Resources Prior advisory: GHSA-44fc-8fm5-q62h Related issue: https://github.com/mozilla/node-convict/issues/423
Recommended action: Upgrade to 6.2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can inject attributes that are used in other components An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash. The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files. Patches The problem is patched in convict@6.2.4. Users should upgrade to convict@6.2.4. Workarounds No way for users to fix or remediate the vulnerability without upgrading References https://github.com/mozilla/node-convict/issues/410
Recommended action: Upgrade to 6.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This affects the package convict before 6.2.3. This is a bypass of CVE-2022-22143. The fix introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with proto or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.proto or foo.this.constructor.prototype.
Recommended action: Upgrade to 6.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can inject attributes that are used in other components An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash. The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files. Patches The problem is patched in convict@6.2.3. Users should upgrade to convict@6.2.3. Workarounds No way for users to fix or remediate the vulnerability without upgrading References https://www.huntr.dev/bounties/1-npm-convict/ #384 3b86be087d8f14681a9c889d45da7fe3ad9cd880 1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75 For more information If you have any questions or comments about this advisory: add your question as a…
Recommended action: Upgrade to 6.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.