CVE-2020-7774: Prototype Pollution
Overview
The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.
POC
js const y18n = require('y18n')();
y18n.setLocale('proto'); y18n.updateLocale({polluted: true});
console.log(polluted); // true
Recommendation
Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.
Other sources
A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n's locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.
Node.js y18n module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
This affects the package y18n before 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('proto'); y18n.updateLocale({polluted: true}); console.log(polluted); // true
Upstream patch: https://github.com/yargs/y18n/pull/108
— Red Hat
This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-nodejs12-nodejsto a version that resolves this vulnerability.Fixed in 0:12.19.1-2.el7 - Upgrade
Upgrade
redhat/rh-nodejs14-nodejsto a version that resolves this vulnerability.Fixed in 0:14.15.4-2.el7 - Upgrade
Upgrade
redhat/rh-nodejs10-nodejsto a version that resolves this vulnerability.Fixed in 0:10.23.1-2.el7 - Upgrade
Upgrade
npm/y18nto a version that resolves this vulnerability.Fixed in 5.0.5 - Upgrade
Upgrade
npm/y18nto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
npm/y18nto a version that resolves this vulnerability.Fixed in 3.2.2 - Upgrade
Upgrade
redhat/nodejs-y18nto a version that resolves this vulnerability.Fixed in 5.0.5 - Upgrade
Upgrade
redhat/nodejs-y18nto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.24.1Fixed in 12.22.1Fixed in 14.16.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.24.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.22.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.16.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.14.0 - Upgrade
Upgrade
y18nto a version that resolves this vulnerability.Fixed in 3.2.2 - Upgrade
Upgrade
y18nto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
y18nto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-7774?
CVE-2020-7774 is a vulnerability in the npm package y18n that allows for Prototype Pollution.
How severe is the vulnerability CVE-2020-7774?
The severity of CVE-2020-7774 is critical, with a severity value of 9.8.
How can I fix CVE-2020-7774?
To fix CVE-2020-7774, you should upgrade to version 5.0.5 of the y18n package.
What is Prototype Pollution?
Prototype Pollution is a vulnerability that allows an attacker to modify the behavior of objects by polluting their prototype.
Where can I find more information about CVE-2020-7774?
You can find more information about CVE-2020-7774 on the NIST National Vulnerability Database website.