Prototype pollution vulnerability in function DEFNODE

General
1

There is an issue in my node package "uglify-js": "3.16.3" Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS via the name variable in ast.js. You can see more on this link here

2

How is this related to Node-RED?
If it is connected to a NR node, it would help if you identified the node and provided information such as
Node-RED version
node.js version
npm version
platform you are running on
OS you are using and version

3

If this is related to the core of node-red, then reporting any possible security issue via the public forum is not the way to do it.

Our responsible disclosure policy is documented here: node-red/SECURITY.md at master · node-red/node-red · GitHub

4

FWIW, uglify is not used / never loaded into memory.

The Dependency (should probably be removed) : node-red/package.json at 946def022fa94e9998d5c6095838841a1c94e2da · node-red/node-red · GitHub

Only reference: node-red/registry.js at 946def022fa94e9998d5c6095838841a1c94e2da · node-red/node-red · GitHub

5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.