Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
Vulnerability Description
content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves disabling prototype method in NodeJS, neutralizing all possible prototype pollution attacks. Provide either --disable-proto=delete (recommended) or --disable-proto=throw as an argument to node to enable this feature.
CVSS Information
N/A
Vulnerability Type
CWE-1321
Vulnerability Title
Content Security Policy parser 安全漏洞
Vulnerability Description
Content Security Policy parser是Helmet开源的一个用于解析内容安全策略指令的软件。 Content Security Policy parser 0.5.0及之前版本存在安全漏洞，该漏洞源于原型污染，可能导致对象原型被覆盖。
CVSS Information
N/A
Vulnerability Type
N/A