Packages / class-transformer / Security

ModerateVulnerabilityGHSA-6gp3-h3jj-prx4CVE-2020-7637SNYK-JS-CLASSTRANSFORMER-564431Published 7 Apr 2020

Prototype pollution in class-transformer

Affected releases · class-transformer

  • 0.2.x and older0.1.0 – 0.2.3No fix, no longer updated

0.2.x has no fix yet; the newest fixed line:

npm install class-transformer@0.3.1

  1. Affected

    0.1.0 – 0.2.3

    15 releases

  2. Fixed

    0.3.1 – 0.5.1

    6 releases, latest

21 stable releases of class-transformer, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for class-transformer. It is read in your browser and sent nowhere.

What happens

class-transformer through 0.2.3 is vulnerable to Prototype Pollution. The 'classToPlainFromExist' function could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload.