Packages / immer / Security

CriticalVulnerabilityGHSA-33f9-j839-rf8hCVE-2021-23436Published 2 Sep 2021

Prototype Pollution in immer

Your version

Affected releases · immer

  • 9.x9.0.0 – 9.0.5Fixed in 9.0.6
  • 8.x and older7.0.0 – 8.0.4No fix, no longer updated

On 9.x, the newest line:

npm install immer@9.0.6
Every release on a timeline
11.x

  1. Not affected

    11.0.0 – 11.2.9

    35 releases, latest

9.x

  1. Affected

    9.0.0 – 9.0.5

    6 releases

  2. Fixed

    9.0.6 – 9.0.21

    16 releases

8.x

  1. Affected

    8.0.0 – 8.0.4

    5 releases

7.x

  1. Affected

    7.0.0 – 7.0.15

    16 releases

193 stable releases of immer, oldest to newest, one row per major.

What happens

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.