Bug 1986170 (CVE-2021-23413) - CVE-2021-23413 jszip: crafting a new zip file with filenames set to object prototype values results in a returned object with a modified prototype instance
Summary: CVE-2021-23413 jszip: crafting a new zip file with filenames set to object pr...
Keywords:
Status: NEW
Alias: CVE-2021-23413
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 1989406
Blocks: 1986171
TreeView+ depends on / blocked
 
Reported: 2021-07-26 20:02 UTC by Guilherme de Almeida Suckevicz
Modified: 2024-03-14 14:43 UTC (History)
15 users (show)

Fixed In Version: jszip 3.7.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in JSZip. Crafting a new zip file with filenames set to Object prototype values (ex. __proto__, toString, etc.) results in a returned object with a modified prototype instance. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-07-26 20:02:36 UTC 
This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

Reference:
https://snyk.io/vuln/SNYK-JS-JSZIP-1251497

Upstream patch:
https://github.com/Stuk/jszip/pull/766
https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b36
Note You need to log in before you can comment on or make changes to this bug.