Fix CVE–2021–23397

[debricked-staging]

CVE–2021–23397

Vulnerable dependency:     merge (npm)    1.2.1

Vulnerability details

Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

NVD

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.

GitHub

@ianwalter/merge Prototype Pollution via merge function

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. @ianwalter/merge is deprecated and the maintainer suggests using @generates/merger instead.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    NVD - CVE-2021-23397
    @ianwalter/merge Prototype Pollution via merge function · CVE-2021-23397 · GitHub Advisory Database · GitHub
    Prototype Pollution in @ianwalter/merge | CVE-2021-23397 | Snyk

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE