CVE-2020-7774: Prototype Pollution
Overview
The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.
POC
js const y18n = require('y18n')();
y18n.setLocale('proto'); y18n.updateLocale({polluted: true});
console.log(polluted); // true
Recommendation
Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.
Other sources
A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n's locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.
Node.js y18n module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
This affects the package y18n before 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('proto'); y18n.updateLocale({polluted: true}); console.log(polluted); // true
Upstream patch: https://github.com/yargs/y18n/pull/108
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-7774?
CVE-2020-7774 is a vulnerability in the npm package y18n that allows for Prototype Pollution.
How severe is the vulnerability CVE-2020-7774?
The severity of CVE-2020-7774 is critical, with a severity value of 9.8.
How can I fix CVE-2020-7774?
To fix CVE-2020-7774, you should upgrade to version 5.0.5 of the y18n package.
What is Prototype Pollution?
Prototype Pollution is a vulnerability that allows an attacker to modify the behavior of objects by polluting their prototype.
Where can I find more information about CVE-2020-7774?
You can find more information about CVE-2020-7774 on the NIST National Vulnerability Database website.