CVE-2022-21803 — Prototype Pollution
This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that …
Published: 2022-04-12 · CVSS: 7.3 · CVSS 3.1
This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7