search

stealjs / steal

Gets JavaScript
https://stealjs.com
MIT License
1.37k stars 522 forks source link

[CVE-2022-37257]/prototype-pollution found in npm-convert.js #1526

Open secdevlpr26 opened 2 years ago

secdevlpr26 commented 2 years ago

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.

The prototype pollution vulnerability can be mitigated with several best practices described here: https://learn.snyk.io/lessons/prototype-pollution/javascript/