{"id":"GHSA-c3px-v9c7-m734","summary":"Prototype Pollution in mithril","details":"Affected versions of `mithril`are vulnerable to prototype pollution. The function `parseQueryString` may allow a malicious user to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. A payload such as `__proto__%5BtoString%5D=123` in the query string would change the `toString()` function to `123`.\n\n\n\n## Recommendation\n\nIf you are using mithril 2.x, upgrade to version 2.0.2 or later.\nIf you are using mithril 1.x, upgrade to version 1.1.7 or later.","modified":"2020-08-31T18:47:02Z","published":"2020-09-03T19:04:39Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2020-08-31T18:47:02Z","nvd_published_at":null,"cwe_ids":["CWE-1321"]},"references":[{"type":"WEB","url":"https://www.npmjs.com/advisories/1094"}],"affected":[{"package":{"name":"mithril","ecosystem":"npm","purl":"pkg:npm/mithril"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-c3px-v9c7-m734/GHSA-c3px-v9c7-m734.json"}},{"package":{"name":"mithril","ecosystem":"npm","purl":"pkg:npm/mithril"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-c3px-v9c7-m734/GHSA-c3px-v9c7-m734.json"}}],"schema_version":"1.9.0"}