-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jsii | npm | >= 5.7.0, < 5.7.3 | 5.7.3 |
| jsii | npm | >= 5.6.0, < 5.6.4 | 5.6.4 |
| jsii | npm | >= 5.5.0, < 5.5.15 | 5.5.15 |
| jsii | npm | >= 5.4.0, < 5.4.46 | 5.4.46 |
Miggo AIRoot Cause AnalysisThe vulnerability documentation explicitly identifies jsii.configureCategories() as the entry point. The example shows prototype pollution occurs when untrusted input is passed to this function. The patch notes reference changes to 'use maps instead of literals in configureCategories', indicating the function was previously using unsafe object property assignment. The CWE-1321 (Prototype Pollution) classification aligns with this function's behavior of merging user input into objects without sanitizing prototype-modifying properties like proto.
JavaScriptJavaScriptFor more information about javascript prototype pollution, see [1].
Sanitize user input to configureCategories() by stripping the proto property if detected.
If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our issue reporting page [2] or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
[1] https://learn.snyk.io/lesson/prototype-pollution/
We would like to thank Tariq Hawis for collaborating on this issue through the coordinated vulnerability disclosure process.
Ongoing coverage of React2Shell