Prototype Pollution

2023-05-0802:35:45

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

prototype pollution

meta.ts

resolvemetadatarecord

meta decoder

metadatarecord

software

EPSS

0.001

Percentile

32.3%

JSON

@aedart/support is vulnerable to Prototype Pollution. The vulnerability exists in the resolveMetadataRecord function of meta.ts when merged with a base class metadata object in the meta decoder, which allows an attacker to inject properties into existing prototypes via the MetadataRecord attribute.