ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
CVE-2019-20149 - Medium Severity Vulnerability
Get the native type of a value.
Library home page: https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz
Path to dependency file: /tmp/ws-scm/batimagen/package.json
Path to vulnerable library: /tmp/ws-scm/batimagen/node_modules/kind-of/package.json
Dependency Hierarchy: - pug-2.0.3.tgz (Root Library) - pug-filters-3.1.0.tgz - uglify-js-2.8.29.tgz - yargs-3.10.0.tgz - cliui-2.1.0.tgz - center-align-0.1.3.tgz - align-text-0.1.4.tgz - :x: **kind-of-3.2.2.tgz** (Vulnerable Library)
Found in HEAD commit: 493cbe24d8ebe21f21db697094d361ce17d6718d
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Publish Date: 2019-12-30
URL: CVE-2019-20149
Base Score Metrics not available
Step up your Open Source Security Game with WhiteSource here