Security vulnerability found in dot-prop

Security vulnerability found

Vulnerable module: dot-prop Introduced through: compare-func@1.3.2

Detailed paths

• Introduced through: conventional-changelog-angular@5.0.6 › compare-func@1.3.2 › dot-prop@3.0.0

https://app.snyk.io/test/npm/conventional-changelog-angular/5.0.6

Overview

dot-prop is a package to get, set, or delete a property from a nested object using a dot path.

Affected versions of this package are vulnerable to Prototype Pollution. It is possible for a user to modify the prototype of a base object.

PoC by aaron_costello

var dotProp = require("dot-prop")
const object = {};
console.log("Before " + object.b); //Undefined
dotProp.set(object, '__proto__.b', true);
console.log("After " + {}.b); //true

Remediation

Upgrade dot-prop to version 5.1.1 or higher.

References

GitHub Commit HackerOne Report

[viveksharma2175]

I am still getting Prototype Pollution vulnerability for dot-prop through “conventional-changelog-conventionalcommits”: “4.3.0” used in @commitlint/config-conventional 9.1.2

[danmana]

Fixed by PR #647 Can be closed when conventional-changelog-angular 5.0.11 is released. See #658