stealjs / steal

Gets JavaScript
https://stealjs.com
MIT License
1.37k stars 522 forks source link

[CVE-2022-37266] Prototype pollution found in babel.js #1535

Open secdevlpr26 opened 2 years ago

secdevlpr26 commented 2 years ago

Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.

The prototype pollution vulnerability can be mitigated with several best practices described here: https://learn.snyk.io/lessons/prototype-pollution/javascript/