Skip to content

A question about CVE-2022-24999 #497

Closed
@heheda1212138

Description

@heheda1212138

Hi, i'm looking at CVE-2022-24999 vulnerability, but i'm confused about how Prototype Pollution is caused, i read the source code, i think the [hasOwnProperty] function has filtered 'proto' attribution, and even if i set 'allowPrototype' as true, it will asign an object to 'proto', so it won't cause Prototype Pollution.
So, if you can give me some hint, i'll appreciate it very much!

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions