Vulnerability · Published Mar 25, 2024 · Assigned by snyk
CVE-2024-21505
High 7.5
In plain English
A high-severity prototype pollution in web3-utils. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | web3-utils | 4.2.1 | GHSA-2g4c-8fpm-c46v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | web3-utils | 0 – before 4.2.1 |
Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P