Homepage
About Snyk

@uifabric/utilities@5.0.0-beta.12 vulnerabilities

Fluent UI React utilities for building components.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @uifabric/utilities package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Prototype Pollution

@uifabric/utilities is a package that includes a number of basic utility functions required by most Fluent UI React components.

Affected versions of this package are vulnerable to Prototype Pollution. The merge function available within the utilities package of FabricUI allows one object to merge with another recursively. Given a value such as __proto__, this value is merged without any prior validation. __proto__ will modify the properties of all existing properties and new properties resulting in pollution of an object's prototype.

PoC

var util = require("@uifabric/utilities");
var malicious_payload = '{"__proto__":{"vulnerable":"Polluted"}}';
var source2 = {
    k3: { }  
  };

y = util.merge(source2, JSON.parse(malicious_payload));
console.log({}.vulnerable);

How to fix Prototype Pollution?

Upgrade @uifabric/utilities to version 7.20.3 or higher.

<7.20.3
Go back to all versions of this package