vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.
References
Link | Resource |
---|---|
https://github.com/vega/vega/commit/8f33a0b5170d7de4f12fc248ec0901234342367b | Patch Third Party Advisory |
https://snyk.io/vuln/SNYK-JS-VEGAUTIL-559223 | Exploit Third Party Advisory |
https://github.com/vega/vega/commit/8f33a0b5170d7de4f12fc248ec0901234342367b | Patch Third Party Advisory |
https://snyk.io/vuln/SNYK-JS-VEGAUTIL-559223 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 04:19
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/vega/vega/commit/8f33a0b5170d7de4f12fc248ec0901234342367b - Patch, Third Party Advisory | |
References | () https://snyk.io/vuln/SNYK-JS-VEGAUTIL-559223 - Exploit, Third Party Advisory |
02 Dec 2022, 19:36
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-1321 |
Information
Published : 2020-03-09 16:15
Updated : 2024-11-21 04:19
NVD link : CVE-2019-10806
Mitre link : CVE-2019-10806
CVE.ORG link : CVE-2019-10806
JSON object : View
Products Affected
vega_project
- vega
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')