Improperly Controlled Modification of Dynamically-Determined Object Attributes Affecting @wordpress/url package, versions <3.7.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-WORDPRESSURL-8651445
- published22 Jan 2025
- disclosed11 Mar 2022
- creditResearchers from Johns Hopkins University
Introduced: 11 Mar 2022
CVE NOT AVAILABLE CWE-915 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade @wordpress/url to version 3.7.1 or higher.
Overview
@wordpress/url is a WordPress URL utilities.
Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through the block editor. An attacker can manipulate the object prototype, leading to potential unauthorized access or modification of data by injecting malicious scripts into the web application.