Fluid Attacks Database

Description

jrburke requirejs vulnerable to prototype pollution jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	requirejs	=2.3.6+ds+~2.1.34-2 \|\| =2.3.6+ds+~2.1.37-1 \|\| =2.3.7+ds+~2.1.37-1 \|\| =2.3.8+ds+~2.1.37-1	-
debian 13	requirejs	>=0 <2.3.7+ds+~2.1.37-1	2.3.7+ds+~2.1.37-1
debian 14	requirejs	>=0 <2.3.7+ds+~2.1.37-1	2.3.7+ds+~2.1.37-1
debian 11	requirejs	=2.3.6+ds+~2.1.34-1 \|\| =2.3.6+ds+~2.1.34-2 \|\| =2.3.6+ds+~2.1.37-1 \|\| =2.3.6+ds-1 \|\| =2.3.7+ds+~2.1.37-1 \|\| =2.3.8+ds+~2.1.37-1	-
npm	requirejs	>=0 <2.3.7	2.3.7

Aliases

1. CVE-2024-389992. NVD-2024-389993. OSV-DEBIAN-2024-389994. OSV-2024-389995. GCVE-2024-389996. SECURITY-TRACKER-CVE-2024-38999

References

1. https://github.com/requirejs/r.js/issues/10152. https://github.com/requirejs/requirejs/issues/18543. https://github.com/requirejs/requirejs/pull/1856/commits/ebd7a2ff71473542fa132d0d15c10fb4ed1539e14. https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.