[material-ui] Prototype pollution security vulnerabililty in @mui/utils

[rsellucian]

Steps to reproduce

Run a snyk scan on version v5.15.19 of MUI.

Current behavior

Snyk is reporting a high-priority prototype pollution issue in @mul/utils

https://security.snyk.io/vuln/SNYK-JS-MUIUTILS-7231125

Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-MUIUTILS-7231125] in @mui/utils@5.15.14
    introduced by @mui/lab@5.0.0-alpha.169 > @mui/utils@5.15.14 and 9 other path(s)
  This issue was fixed in versions: 6.0.0-alpha.9

This issue was addressed in MUI 6.0.0-alpha.9, (see conversation here), but it has not been backported to the latest release of 5.x (5.15.19).

Will this be addressed in version 5.x of MUI as well?

Expected behavior

No prototype pollution vulnerabilities detected.

Context

No response

Your environment

npx @mui/envinfo

  System:
    OS: macOS 14.4.1
  Binaries:
    Node: 18.17.0 - ~/.nvm/versions/node/v18.17.0/bin/node
    npm: 9.6.7 - ~/.nvm/versions/node/v18.17.0/bin/npm
    pnpm: Not Found
  Browsers:
    Chrome: 125.0.6422.142
    Edge: 125.0.2535.92
    Safari: 17.4.1
  npmPackages:
    @emotion/react: 11.10.5 => 11.10.5 
    @emotion/styled: 11.10.5 => 11.10.5 
    @mui/base:  5.0.0-beta.40 
    @mui/core-downloads-tracker:  5.15.19 
    @mui/lab: 5.0.0-alpha.169 => 5.0.0-alpha.169 
    @mui/material: 5.15.5 => 5.15.5 
    @mui/private-theming:  5.15.14 
    @mui/styled-engine:  5.15.14 
    @mui/styles: 5.15.5 => 5.15.5 
    @mui/system:  5.15.15 
    @mui/types:  7.2.14 
    @mui/utils:  5.15.14 
    @types/react: 17.0.65 => 17.0.65 
    react: 17.0.2 => 17.0.2 
    react-dom: 17.0.2 => 17.0.2 
    typescript:  5.4.5 ```
</details>


**Search keywords**: security prototype pollution deepmerge

[DiegoAndai]

Thanks for the report @rsellucian! I created a PR to cherry pick the fix to v5

[rsellucian]

@DiegoAndai Thank you for jumping on this so quickly.

[oliviertassinari]

@tjcouch-sil could you flag https://security.snyk.io/vuln/SNYK-JS-MUIUTILS-7231125 as false? It has no reproductions, so would tend to confirm #41652 (comment).

[tjcouch-sil]

@tjcouch-sil could you flag https://security.snyk.io/vuln/SNYK-JS-MUIUTILS-7231125 as false? It has no reproductions, so would tend to confirm #41652 (comment).

Unfortunately I don't have any direct access to be able to flag it directly, but I submitted a request for them to flag it as a false positive. Context here

[oliviertassinari]

@tjcouch-sil Ok, thanks

[tjcouch-sil]

Snyk let me know they're investigating the report. I'll keep you updated!

[tjcouch-sil]

Update: the issue is up to their R&D team to do further investigation.

[oliviertassinari]

Ok, it was closed, back to normal 👍

https://security.snyk.io/vuln/SNYK-JS-MUIUTILS-7231125