-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| steal | npm | <= 2.3.0 |
Miggo AIRoot Cause AnalysisThe vulnerability occurs because convertLater() uses unsanitized user-controlled input (packageName) to modify the prototype chain via context.deferredConversions. When handling dependencies with crafted package names (e.g., 'proto.polluted'), the code inadvertently modifies the Object prototype. This matches the CWE-1321 pattern of improper prototype attribute modification. The code references in GHSA-gvjw-8mmr-8f6g and line 369 of npm-convert.js confirm this flow.