CVE-2020-28269

Vulnerability

Overview

The field npm package, versions 0.0.1 through 1.0.1, contains a prototype pollution vulnerability. The library's set function (see lib/field.js line 39 [2]) recursively assigns nested properties without checking for __proto__, constructor, or prototype keys. This allows an attacker to inject properties into Object.prototype [1].

Exploitation

An attacker can exploit this by supplying a crafted object path that includes __proto__ or constructor.prototype as a key. When the application uses field to set a value based on user input, the prototype becomes polluted. No authentication is required if the input is exposed to untrusted users [3].

Impact

Successful prototype pollution can cause denial of service by breaking object iteration or triggering infinite loops. More critically, it may lead to remote code execution if the polluted property influences security-sensitive operations (e.g., property access in template engines or event handlers) [1][3].

Mitigation

The field repository has been archived and is no longer maintained. Users should migrate to an alternative library that properly sanitizes keys. No official patch is available for this vulnerability [2].