@uifabric/utilities/.../utilities@7.0.0-alpha012 vulnerabilities

Fluent UI React utilities for building components.

  • latest version

    7.38.2

  • latest non vulnerable version

  • first published

    7 years ago

  • latest version published

    2 years ago

  • licenses detected

  • Direct Vulnerabilities

    Known vulnerabilities in the @uifabric/utilities package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Prototype Pollution

    @uifabric/utilities is a package that includes a number of basic utility functions required by most Fluent UI React components.

    Affected versions of this package are vulnerable to Prototype Pollution. The merge function available within the utilities package of FabricUI allows one object to merge with another recursively. Given a value such as __proto__, this value is merged without any prior validation. __proto__ will modify the properties of all existing properties and new properties resulting in pollution of an object's prototype.

    PoC

    var util = require("@uifabric/utilities");
    var malicious_payload = '{"__proto__":{"vulnerable":"Polluted"}}';
    var source2 = {
        k3: { }  
      };
    
    y = util.merge(source2, JSON.parse(malicious_payload));
    console.log({}.vulnerable);
    

    How to fix Prototype Pollution?

    Upgrade @uifabric/utilities to version 7.20.3 or higher.

    <7.20.3