-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| radashi | npm | < 12.5.1 | 12.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a prototype pollution issue within the set function of the Radashi library. The provided commit 8147abc8cfc3cfe9b9a17cd389076a5d97235a66 clearly shows the patch applied to src/object/set.ts.
The core of the vulnerability lies in the set function, which, prior to the patch, did not validate the keys being used to set properties on an object. An attacker could provide a path containing __proto__, prototype, or constructor as a key, leading to the modification of the Object prototype.
The patch introduces a new helper function isDangerousKey (in src/object/isDangerousKey.ts) which is then used within the set function to check if the current key in the path is one of these dangerous keys. If a dangerous key is detected and the object does not have a null prototype, an error is thrown, preventing the pollution.
Therefore, the set function in src/object/set.ts is the vulnerable function as it's the one that processes the potentially malicious input (the path) and, without the patch, would perform the unsafe operation. The isDangerousKey function is part of the mitigation, not the vulnerability itself.
A Semantic Attack on Google Gemini - Read the Latest Research