flat@1.5.1 vulnerabilities

Take a nested Javascript object and flatten it, or unflatten an object with delimited keys

Direct Vulnerabilities

Known vulnerabilities in the flat package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Prototype Pollution

flat is a Take a nested Javascript object and flatten it, or unflatten an object with delimited keys

Affected versions of this package are vulnerable to Prototype Pollution.

PoC

var unflatten = require('flat').unflatten;

unflatten({
'__proto__.polluted': true
});

console.log(polluted); // true

How to fix Prototype Pollution?

Upgrade flat to version 5.0.2, 4.1.1, 3.0.1, 2.0.2, 1.6.2 or higher.

>=5.0.0 <5.0.2 >=4.0.0 <4.1.1 >=3.0.0 <3.0.1 >=2.0.0 <2.0.2 <1.6.2