Description
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a min-dash
unspecified to < 3.8.1affected
References
- https://snyk.io/vuln/SNYK-JS-MINDASH-2340605 ↗
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2342127 ↗
- https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js%23L32 ↗
- https://github.com/bpmn-io/min-dash/pull/21 ↗
- https://github.com/bpmn-io/min-dash/pull/21/commits/5ab05cbc4fd8d5eafb7db540c491ed0906b9d320 ↗