grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload
Date: 2022-07
Affected: npm/grunt-util-property
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2020-7641
CWE: CWE-1321
CVSS: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.


Mitigations:

Architectural layers (MAESTRO):