| Package | Affected versions | Patched versions |
|---|---|---|
| rollbar | ≤ 2.26.4 | |
| rollbar | ≥ 3.0.0-alpha1, < 3.0.0-beta5< 2.26.5 | 3.0.0-beta52.26.5 |
Prototype pollution potential with the utility function rollbar/src/utility.set(). No impact when using the published public interface.
If application code directly imports set from rollbar/src/utility and then calls set with untrusted input in the second argument, it is vulnerable to prototype pollution.
POC:
const obj = {};
require("rollbar/src/utility").set(obj, "__proto__.polluted", "vulnerable");
console.log({}.polluted !== undefined ? '[POLLUTION_TRIGGERED]':'');
Fixed in version 2.26.5 and 3.0.0-beta5.
If application code directly imports set from rollbar/src/utility, ensure that the second argument does not receive untrusted input.
https://github.com/rollbar/rollbar.js/issues/1333#issuecomment-3353720946
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free