Fluid Attacks Database

Description

jszip Vulnerable to Prototype Pollution This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	jszip	>=3.0.0 <3.7.0 \|\| >=0 <2.7.0	3.7.0, 2.7.0
debian 12	node-jszip	>=0 <3.5.0+dfsg-2	3.5.0+dfsg-2
debian 13	node-jszip	>=0 <3.5.0+dfsg-2	3.5.0+dfsg-2
debian 14	node-jszip	>=0 <3.5.0+dfsg-2	3.5.0+dfsg-2

Aliases

1. CVE-2021-234132. NVD-2021-234133. OSV-2021-234134. OSV-DEBIAN-2021-234135. GCVE-2021-234136. SECURITY-TRACKER-CVE-2021-23413

References

1. https://github.com/Stuk/jszip/pull/7662. https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b363. https://github.com/Stuk/jszip/blob/master/lib/object.js%23L88

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.