Prototype pollution vulnerability in utils-merge

Hi, we are a security team. We found a prototype pollution vulnerability in your project.

The issue affects utils-merge.

The vulnerable behavior happens when properties from a user-controlled source object are copied into a target object through dynamic property assignment. If a special key such as __proto__ is present, prototype pollution may occur.

Impact

An attacker may be able to change the prototype of the target object in the affected runtime.

Proof of concept

const merge = require('utils-merge');

const target = {};
merge(target, { ['__proto__']: { polluted: true } });

console.log(target.polluted); // true

Details

We confirmed the following case:

• sink: ./index.js:19

The root cause is that untrusted keys are copied through dynamic property writes without blocking special prototype-related keys.

Start at ./index.js:19, where properties from the source object are copied through dynamic assignment. Reproduce the provided proto example and inspect the existing tests, then add coverage showing that special prototype-related keys cannot pollute the target. Run the project test suite and confirm the proof of concept no longer changes the target prototype.