AIKIDO-2025-10703
informed is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
71
High Risk
This Affects:
informedTL;DR
Affected versions of this package are vulnerable to prototype pollution in the ObjectMap.set() function, where an attacker could exploit unsanitized property paths by submitting malicious input containing dangerous property names like proto, constructor, or prototype to modify the Object prototype, potentially leading to application behavior manipulation, security control bypass, or denial of service.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
informed is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 3.23.0 - 4.66.0.
How to fix this
Upgrade the informed library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant