search

jonschlinkert / kind-of

Get the native JavaScript type of a value, fast. Used by superstruct, micromatch and many others!
https://github.com/jonschlnkert
MIT License
350 stars 38 forks source link

Detected vulnerability #37

Closed technerdev closed 3 years ago

technerdev commented 3 years ago

Service: FOSSA(app.fossa.com)

Vulnerability Code: CVE-2019-20149

Description: ctorName in index.js in kind-of v6.0.3 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by ‘constructor’: {‘name’:‘Symbol’}. Hence, a crafted payload can overwrite this built-in attribute to manipulate the type detection result.

doowb commented 3 years ago

This was patched in 6.0.3 so is not affected by this. (The linked CVE even says < 6.0.3.) If you are having problems, try using this guide to ensure you have the latest patched version.