Vulnerability · Published Sep 1, 2021 · Assigned by snyk

CVE-2021-23436Prototype Pollution

Medium 5.6

In plain English

A medium-severity security flaw in immer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)1.8%top 21.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	immer	9.0.6	GHSA-33f9-j839-rf8h

Affected products (as reported)

Vendor	Product	Versions
n/a	immer	unspecified – before 9.0.6

References

https://snyk.io/vuln/SNYK-JS-IMMER-1540542 x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579266 x_refsource_MISC
https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237 x_refsource_MISC