vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2020-03-09T16:00:54

Updated: 2024-08-04T22:32:02.154Z

Reserved: 2019-04-03T00:00:00

Link: CVE-2019-10806

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-03-09T16:15:11.500

Modified: 2024-11-21T04:19:57.413

Link: CVE-2019-10806

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-03-09T00:00:00Z

Links: CVE-2019-10806 - Bugzilla