Prototype Pollution

Vulnerability

The sds package, versions from 0.0.0, is vulnerable to prototype pollution through the set function in js/set.js [1]. This is an incomplete fix for CVE-2020-7618 [2]. The library can be tricked into adding or modifying properties of Object.prototype [1].

Exploitation

An attacker can exploit this by providing a crafted input to the set function that manipulates the prototype chain, for example by using __proto__ or constructor.prototype paths [3]. No authentication is required if the function processes user-supplied data.

Impact

Successful exploitation leads to prototype pollution, which can cause denial of service via JavaScript exceptions or tamper with application source code to force code paths, potentially leading to remote code execution [3].

Mitigation

As of the references available, no fixed version for sds has been disclosed to address CVE-2022-25862 [1]. Users should consider avoiding use of this library or implementing input sanitization to block prototype property keys.