Prototype Pollution In aws-sdk
Description
Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 2.814.0 | ||
npm | 1.0.0-rc.9 |
Aliases
1. 2. 3. 4.
References
1. 2.