Low, CVSS 3.7npmAmendedPublished
Prototype pollution in jsii.configureCategories
GHSA-m56h-5xx3-2jc2
- Affected
- npm jsii >= 5.7.0, < 5.7.3; >= 5.6.0, < 5.6.4; >= 5.5.0, < 5.5.15; >= 5.4.0, < 5.4.46
- Fixed in
- 5.7.35.4.465.5.155.6.4· Vendor fix available
- Issue
- jsii is a TypeScript to JavaScript compiler that also extracts an interface definition manifest to generate RPC stubs in various programming languages. jsii is typically used as a command-line tool, but it can also be loaded as a library. When loaded as a library into a larger application, prototype pollution may happen if untrusted user input is passed to the library. When used as a command line-tool, this pollution cannot occur. Impact You may be impacted if you have written an application that loads jsii as a library, and passes untrusted user input into the jsii.configureCategories() function. In that case, a user can craft input in such a way that, following the invocation, a field named "category" with a user-controlled value is added to the JavaScript Object prototype. This will cause every object in the program (both new and existing) to have a field named "category", even if it shouldn't. This will not affect jsii itself, but it might affect the application you have…
Recommended action: Upgrade to 5.7.3, 5.6.4, 5.5.15 or 5.4.46 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.