REDHAT-BUG-2514177: High severity npm/browserslist vulnerability
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including proto, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
browserslistto a version that resolves this vulnerability.Fixed in 4.28.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications and build or front-end tooling that use npm/browserslist before 4.28.7 and process untrusted browser statistics input are exposed. The affected inputs include browserslist-stats.json, the opts.stats option, and CLI --stats data.
What must an attacker control to exploit it?
An attacker needs to supply or influence statistics data processed by Browserslist. Crafted inherited Object.prototype property names, including __proto__, constructor, toString, valueOf, hasOwnProperty, and isPrototypeOf, can trigger an uncaught TypeError or alter the prototype of the normalized result.
Is the vulnerable code reached during normal Browserslist use?
Yes. normalizeStats() is reached unconditionally through getStat() and loadStat() on every browserslist() call, so the relevant behavior does not require a separate optional code path once affected statistics input is processed.
What should be done if patching is not immediately possible?
Do not accept or process untrusted browserslist-stats.json files, opts.stats values, or CLI --stats input. Restrict these inputs to trusted, validated sources until Browserslist can be updated to 4.28.7.