CVE-2021-25915

Vulnerability

Overview

The NPM package changeset (versions 0.0.1 through 0.2.5) is affected by a prototype pollution vulnerability. The apply() function, which accepts changes, target, and modify arguments, does not validate the type of object before assigning a value to a property. An attacker can inject a malicious changeset containing __proto__ as a key, leading to pollution of the Object prototype [1][2].

Attack

Vector

To exploit, an attacker must supply a crafted changes argument that includes a __proto__ property path. For example, a patch like [{type: 'put', key: ['__proto__','polluted'], value: 'Yes! Its Polluted'}] will directly assign a value to Object.prototype.polluted. No prior authentication is required; the vulnerability can be triggered if an application passes untrusted user input to changeset.apply(). The attack surface is broad because the library is often used for syncing object differences with databases like LevelDB [2][3].

Impact

A successful prototype pollution attack can enable denial of service (DoS) by altering unexpected properties across all objects in the runtime. Under certain conditions—such as when subsequent code checks for the polluted property (e.g., if({}.polluted))—the attacker may achieve remote code execution (RCE) by manipulating property values that control application logic [1][2].

Mitigation

The issue was fixed in version 0.2.6. The commit [4] adds checks via hasOwnProperty() and explicitly excludes the __proto__ key during assignment and deletion operations. Users should upgrade to 0.2.6 or later to prevent prototype pollution [4].