Affected versions of this package are vulnerable to Prototype Pollution via the sdk function due to missing check if the attribute resolves to the object prototype.
To exploit vulnerability, someone may inject a malicious object from a user controllable input to aim function in aim.js. The input resolves to the object prototype thus modify the behavior of the program.
var sdk = require("@aliconnect/sdk")
BAD_JSON = JSON.parse('{"__proto__":{"polluted":true}}');
μPlot is a fast, memory-efficient Canvas 2D-based chart for plotting time series, lines, areas, ohlc & bars;
Affected versions of this package are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.
The module is vulenrable via assign function, the assignment of the property from source to destination occurred without proper validation of the user's input.
I hereby claim:
To claim this, I am signing this object: