Packages / @sentry/browser / Security

ModerateVulnerabilityGHSA-593m-55hh-j8gvPublished 3 Oct 2024

Sentry SDK Prototype Pollution gadget in JavaScript SDKs

Your version

Affected releases · @sentry/browser

  • 8.x8.0.0 – 8.32.0Fixed in 8.33.0
  • 7.x7.0.0 – 7.119.0Fixed in 7.119.1
  • 6.x and older0.1.0 – 6.19.7No fix, no longer updated

On 8.x, the newest line:

npm install @sentry/browser@8.33.0
Every release on a timeline
11.x

  1. Not affected

    11.0.0 – 11.9.0

    10 releases, latest

8.x

  1. Affected

    8.0.0 – 8.32.0

    36 releases

  2. Fixed

    8.33.0 – 8.55.2

    29 releases

7.x

  1. Affected

    7.0.0 – 7.119.0

    166 releases

  2. Fixed

    7.119.1 – 7.120.4

    7 releases

6.x

  1. Affected

    6.0.0 – 6.19.7

    64 releases

5.x

  1. Affected

    5.0.0 – 5.30.0

    86 releases

4.x

  1. Affected

    4.0.0 – 4.6.6

    34 releases

0.x

  1. Affected

    0.1.0 – 0.5.4

    11 releases

587 stable releases of @sentry/browser, oldest to newest, one row per major.

What happens

Impact

In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.

Note

This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.

Patches

The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version. Also, the fix was backported to SDK v7 in 7.119.1.

References