References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-248

CWE-1321

https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51

https://github.com/browserslist/browserslist/releases/tag/4.28.7

https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g

[{"vendor":"browserslist","product":"browserslist","versions":[{"version":"< 4.28.7","status":"affected"}]}]