CVE-2021-3918

json-schema es vulnerable a la Modificación Indebida de Atributos de Prototipos de Objetos ('Contaminación de Prototipos')

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.

An update that fixes 9 vulnerabilities is now available. This update for nodejs10 fixes the following issues. Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe. Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite. Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite. Fixed improper controlled modification of object prototype attributes in json-schema. Fixed regular expression denial of service matching ANSI escape codes in node-ansi-regex. Fixed prototype pollution via console.table. Fixed prototype pollution in npm dependency. Fixed insuficient sanitation in npm dependency. Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm.