Prototype Pollution in node-forge debug API. (CWE-0)

[ckalpakoglu]

A low severity vulnerability has been discovered in your project.

Project Name: kondukto-ui-vue

Scanner Name: dependabot

File: package-lock.json

Packages:

• node-forge:0.10.0

References:

• GHSA-5rrq-pxf6-6jx5
• GHSA-5rrq-pxf6-6jx5

Tool Description: Summary: Prototype Pollution in node-forge debug API..
Description: ### Impact
The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Patches

The forge.debug API and related functions were removed in 1.0.0.

Workarounds

Don't use the forge.debug API directly or indirectly with untrusted input.

References

• https://www.huntr.dev/bounties/1-npm-node-forge/

For more information

If you have any questions or comments about this advisory:

• Open an issue in forge.
• Email us at support@digitalbazaar.com.