confucious@0.0.7 vulnerabilities

App configuration management. Kind of like nconf, but easier to use, predicable and more flexible.

0.0.12

9 years ago

6 years ago

Known vulnerabilities in the confucious package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Prototype Pollution confucious is an App configuration management. Kind of like nconf, but easier to use, predicable and more flexible. Affected versions of this package are vulnerable to Prototype Pollution via the `set` function. POC: `const confucious = require('confucious'); confucious.set('__proto__:polluted', true); console.log(polluted);` How to fix Prototype Pollution? There is no fixed version for `confucious`.	*

confucious is an App configuration management. Kind of like nconf, but easier to use, predicable and more flexible.

Affected versions of this package are vulnerable to Prototype Pollution via the set function.

const confucious = require('confucious');
confucious.set('__proto__:polluted', true);
console.log(polluted);

How to fix Prototype Pollution?

There is no fixed version for confucious.