alexandrejunqueira / reactnd-exercicio-1-passando-dados Goto Github PK

Vulnerable Library - merge-1.2.0.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

path: /reactnd-exercicio-1-passando-dados/node_modules/merge/package.json

Library home page: http://registry.npmjs.org/merge/-/merge-1.2.0.tgz

Dependency Hierarchy:

• ❌ merge-1.2.0.tgz (Vulnerable Library)

Vulnerability Details

The merge.recursive function in the merge package v <1.2 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.

Publish Date: 2018-10-30

URL: CVE-2018-16469

CVSS 2 Score Details (3.4)

Base Score Metrics not available