stealjs / steal

Gets JavaScript
https://stealjs.com
MIT License
1.37k stars 521 forks source link

[CVE-2022-37266] Prototype pollution found in babel.js #1535

Open secdevlpr26 opened 1 year ago

secdevlpr26 commented 1 year ago

Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.

The prototype pollution vulnerability can be mitigated with several best practices described here: https://learn.snyk.io/lessons/prototype-pollution/javascript/