-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the express framework's extended query parser, which is the default in version 4. The parseExtendedQueryString function in lib/utils.js used the qs.parse library with the allowPrototypes: true option. This configuration allows the query string to contain parameters that can modify properties of the global Object.prototype. An attacker could craft a malicious query string like ?hasOwnProperty=foo to overwrite built-in Object methods, potentially leading to application crashes or other unpredictable behavior when other parts of the code rely on these prototype properties. The provided patch addresses this by replacing allowPrototypes: true with plainObjects: true, which instructs qs.parse to create a plain object with a null prototype, effectively isolating the parsed query parameters and preventing prototype pollution.
parseExtendedQueryStringlib/utils.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| express | npm | < 4.22.0 | 4.22.0 |
| express | npm | >= 5.0.0, < 5.1.0 | 5.1.0 |
A Semantic Attack on Google Gemini - Read the Latest Research