Homepage
About Snyk

@fluentui/styles@0.47.11 vulnerabilities

A set of styling utilities for CSS-in-JS.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @fluentui/styles package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Prototype Pollution

@fluentui/styles is a set of styling utilities for CSS-in-JS.

Affected versions of this package are vulnerable to Prototype Pollution. The deepmerge function available within the styles package of FluentUI allows one object to merge with another recursively. Given a value such as __proto__, this value is merged without any prior validation. __proto__ will modify the properties of all existing properties and new properties resulting in pollution of an object's prototype.

PoC

var styles = require("@fluentui/styles");
var malicious_payload = '{"__proto__":{"vulnerable":"Polluted"}}';
var source2 = {
    k3: { }  
  };
var x = styles.deepmerge(source2, JSON.parse(malicious_payload))
console.log({}.vulnerable)

How to fix Prototype Pollution?

Upgrade @fluentui/styles to version 0.50.0 or higher.

<0.50.0
Go back to all versions of this package