CVE-2022-37623 / Prototype pollution vulnerability found in resolve-shims.js

thlorenz / browserify-shim

📩 Makes CommonJS incompatible files browserifyable.

MIT License

934 stars 87 forks source link

CVE-2022-37623 / Prototype pollution vulnerability found in resolve-shims.js #248

Closed secdevlpr26 closed 1 year ago

secdevlpr26 commented 1 year ago

Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js

The prototype pollution vulnerability can be mitigated with several best practices described here: [https://learn.snyk.io/lessons/prototype-pollution/javascript/]

bendrucker commented 1 year ago

https://github.com/thlorenz/browserify-shim/issues/247#issuecomment-1294007474