Low, CVSS 3.7npmAmendedPublished
mcp-data-vis vulnerable to denial of service via unsanitized select key lookup on Object.prototype with precompile: true
GHSA-r27j-894h-3w3p
- Affected
- npm icu-minify <= 4.9.1
- Fixed in
- 4.9.2· Vendor fix available
- Issue
- icu-minify's runtime formatter resolves select branches by looking up the runtime value as a plain property on a prototype-bearing object. When the value coerces to a key that exists on Object.prototype (e.g. toString, proto, constructor, hasOwnProperty, valueOf), the lookup returns a truthy value that short-circuits the ?? options.other fallback, and the downstream iterator crashes with TypeError: nodes is not iterable. Any consumer that forwards user input into a {arg, select, …} placeholder — a common idiom for role, status, type, gender — can be crashed per-request by supplying one of those keys. In Next.js SSR (via next-intl with experimental.messages.precompile) this yields a 500 for the affected render. Details Vulnerable code paths Compilation produces a plain object whose prototype chain includes all Object.prototype members: At runtime, the formatter looks up the user-controllable value directly on that object: Because options inherits from Object.prototype, lookups…
Recommended action: Upgrade to 4.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.