confucious@0.0.9 vulnerabilities

App configuration management. Kind of like nconf, but easier to use, predicable and more flexible.

0.0.12

10 years ago

7 years ago

Known vulnerabilities in the confucious package. This does not include vulnerabilities belonging to this package’s dependencies.

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Prototype Pollution confucious is an App configuration management. Kind of like nconf, but easier to use, predicable and more flexible. Affected versions of this package are vulnerable to Prototype Pollution via the `set` function. POC: `const confucious = require('confucious'); confucious.set('__proto__:polluted', true); console.log(polluted);` How to fix Prototype Pollution? There is no fixed version for `confucious`.	*

confucious is an App configuration management. Kind of like nconf, but easier to use, predicable and more flexible.

Affected versions of this package are vulnerable to Prototype Pollution via the set function.

const confucious = require('confucious');
confucious.set('__proto__:polluted', true);
console.log(polluted);

How to fix Prototype Pollution?

There is no fixed version for confucious.