Closed renovate[bot] closed 1 year ago
This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployments, click below or on the icon next to each commit.
🔍 Inspect: https://vercel.com/yurikrupnik/batman/CYEmhSp7L7jdVREj7Qvrdp1Eknzu
✅ Preview: Failed
🔍 Inspect: https://vercel.com/yurikrupnik/alfred/7qA3rXYfsvxxduMUh2b3Cht1Whk5
✅ Preview: Failed
When attackers are able to manipulate the memory reserved for objects directly, they can then pass a reference to a crafted block of memory to be used in the place of a valid object type. This triggers the run time engine to execute arbitrary code which is under the control of the attacker due to the induced type confusion.
This PR contains the following updates:
0.8.3
->0.8.4
GitHub Vulnerability Alerts
CVE-2021-23438
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['proto']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.