array-sort icon indicating copy to clipboard operation
array-sort copied to clipboard

Published 20 hours ago • verified publisher icon jonschlinkert

Update package.json kind-of ^6.0.3

Open ashergarland opened this issue 4 years ago • 1 comments

Fixing security issue with older versions of kind-of ctorName in index.js in kind-of (v6.0.2 and older) allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

image

ashergarland avatar Feb 27 '20 18:02 ashergarland

@jonschlinkert I was just about to create a similar pull request before I saw this one. So is there any chance to get this change merged?

striezel avatar Jul 03 '21 20:07 striezel