search

stealjs / steal

Gets JavaScript
https://stealjs.com
MIT License
1.37k stars 521 forks source link

[CVE-2022-37261]/Prototype pollution found in npm-extension.js #1530

Open secdevlpr26 opened 1 year ago

secdevlpr26 commented 1 year ago

Prototype pollution vulnerability in function addNpmExtension in npm-extension.js in stealjs steal 2.3.0-pre.0 via the name variable in npm-extension.js.

The prototype pollution vulnerability can be mitigated with several best practices described here: https://learn.snyk.io/lessons/prototype-pollution/javascript/