GeezerVison

Sourced from The GitHub Security Advisory Database.

Prototype Pollution

Overview

The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.

POC

const y18n = require('y18n')();
y18n.setLocale('proto');
y18n.updateLocale({polluted: true});
console.log(polluted); // true

Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.

Affected versions: = 4.0.0

Sourced from y18n's changelog.

4.0.2 (2021-04-07)

Bug Fixes

• security: ensure entry exists for backport (#120) (b22c0df)

5.0.4 (2020-10-16)

Bug Fixes

• exports: node 13.0 and 13.1 require the dotted object form with a string fallback (#105) (4f85d80)

5.0.3 (2020-10-16)

Bug Fixes

• exports: node 13.0-13.6 require a string fallback (#103) (e39921e)

5.0.2 (2020-10-01)

Bug Fixes

• deno: update types for deno ^1.4.0 (#100) (3834d9a)

5.0.1 (2020-09-05)

Bug Fixes

• main had old index path (#98) (124f7b0)

5.0.0 (2020-09-05)

⚠ BREAKING CHANGES

• exports maps are now used, which modifies import behavior.
• drops Node 6 and 4. begin following Node.js LTS schedule (#89)

Features

• add support for ESM and Deno #95) (4d7ae94)

Build System

... (truncated)

• bcfdd05 chore: release (#122)
• af90f17 build: fix json in manifest
• d65aef1 build: add default branch
• 910ff4c build: use appropriate releaser
• b22c0df fix(security): ensure entry exists for backport (#120)
• a9ac604 fix: address prototype pollution issue (#108)
• 61a8b9a chore: release 5.0.4 (#106)
• 4f85d80 fix(exports): node 13.0 and 13.1 require the dotted object form with a stri...
• 3c4e241 chore: release 5.0.3 (#104)
• e39921e fix(exports): node 13.0-13.6 require a string fallback (#103)
• Additional commits viewable in compare view

This version was pushed to npm by oss-bot, a new releaser for y18n since your current version.

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)