Skip to content

chore(deps): update dependency @intlify/shared to v9.14.2 [security] #102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update dependency @intlify/shared to v9.14.2 [security] #102

wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 2, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
@intlify/shared (source) 9.4.1 -> 9.14.2 age confidence

GitHub Vulnerability Alerts

CVE-2024-52810

Vulnerability type: Prototype Pollution

Affected Package:

Product: @​intlify/shared
Version: 10.0.4

Vulnerability Location(s):

node_modules/@​intlify/shared/dist/shared.cjs:232:26

Description:

The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) the minimum consequence.

Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.

PoC:

// install the package with the latest version
~$ npm install @​intlify/[email protected]
// run the script mentioned below 
~$ node poc.js
//The expected output (if the code still vulnerable) is below. 
// Note that the output may slightly differs from function to another.
Before Attack:  {}
After Attack:  {"pollutedKey":123}
(async () => {
const lib = await import('@​intlify/shared');
var someObj = {}
console.log("Before Attack: ", JSON.stringify({}.__proto__));
try {
// for multiple functions, uncomment only one for each execution.
lib.deepCopy (JSON.parse('{"__proto__":{"pollutedKey":123}}'), someObj)
} catch (e) { }
console.log("After Attack: ", JSON.stringify({}.__proto__));
delete Object.prototype.pollutedKey;
})();

References

Prototype Pollution Leading to Remote Code Execution - An example of how prototype pollution can lead to command code injection.

OWASP Prototype Pollution Prevention Cheat Sheet - Best practices for preventing prototype pollution.

PortSwigger Guide on Preventing Prototype Pollution - A detailed guide to securing your applications against prototype pollution.

Release Notes

intlify/vue-i18n (@​intlify/shared)

v9.14.2

Compare Source

What's Changed

🔒 Security Fixes

Full Changelog: intlify/vue-i18n@v9.14.1...v9.14.2

v9.14.1

Compare Source

What's Changed

🐛 Bug Fixes

Full Changelog: intlify/vue-i18n@v9.14.0...v9.14.1

v9.14.0

Compare Source

What's Changed

⚡ Improvement Features

Full Changelog: intlify/vue-i18n@v9.13.1...v9.14.0

v9.13.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

Full Changelog: intlify/vue-i18n@v9.13.0...v9.13.1

v9.13.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

⚠️ Deprecated Features
⚡ Improvement Features
📝️ Documentations

New Contributors

Full Changelog: intlify/vue-i18n@v9.12.1...v9.13.0

v9.12.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes
👕 Refactoring

Full Changelog: intlify/vue-i18n@v9.12.0...v9.12.1

v9.12.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

Full Changelog: intlify/vue-i18n@v9.11.1...v9.12.0

v9.11.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

Full Changelog: intlify/vue-i18n@v9.11.0...v9.11.1

v9.11.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

New Contributors

Full Changelog: intlify/vue-i18n@v9.10.2...v9.11.0

v9.10.2

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

New Contributors

Full Changelog: intlify/vue-i18n@v9.10.1...v9.10.2

v9.10.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features
📝️ Documentations

New Contributors

Full Changelog: intlify/vue-i18n@v9.10.0...v9.10.1

v9.10.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features
📝️ Documentations

New Contributors

Full Changelog: intlify/vue-i18n@v9.9.1...v9.10.0

v9.9.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes
📝️ Documentations

New Contributors

Full Changelog: intlify/vue-i18n@v9.9.0...v9.9.1

v9.9.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features
📈 Performance Fixes
📝️ Documentations

New Contributors

Full Changelog: intlify/vue-i18n@v9.8.0...v9.9.0

v9.8.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

Full Changelog: intlify/vue-i18n@v9.7.1...v9.8.0

v9.7.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features

Full Changelog: intlify/vue-i18n@v9.7.0...v9.7.1

v9.7.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

Full Changelog: intlify/vue-i18n@v9.6.5...v9.7.0

v9.6.5

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

New Contributors

Full Changelog: intlify/vue-i18n@v9.6.4...v9.6.5

v9.6.4

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

Full Changelog: intlify/vue-i18n@v9.6.3...v9.6.4

v9.6.3

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

New Contributors

Full Changelog: intlify/vue-i18n@v9.6.2...v9.6.3

v9.6.2

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

Full Changelog: intlify/vue-i18n@v9.6.1...v9.6.2

v9.6.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

Full Changelog: intlify/vue-i18n@v9.6.0...v9.6.1

v9.6.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features
🐛 Bug Fixes
⚡ Improvement Features
📝️ Documentations

Full Changelog: intlify/vue-i18n@v9.5.0...v9.6.0

v9.5.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features
🐛 Bug Fixes
📝️ Documentations
🍭 Examples

New Contributors

Full Changelog: intlify/vue-i18n@v9.4.1...v9.5.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot changed the title fix(deps): update dependency @intlify/shared to v9.14.2 [security] fix(deps): update dependency @intlify/shared to v9.14.2 [security] - autoclosed Dec 8, 2024
@renovate renovate bot closed this Dec 8, 2024
@renovate renovate bot deleted the renovate/npm-intlify-shared-vulnerability branch December 8, 2024 19:01
@renovate renovate bot changed the title fix(deps): update dependency @intlify/shared to v9.14.2 [security] - autoclosed fix(deps): update dependency @intlify/shared to v9.14.2 [security] Dec 8, 2024
@renovate renovate bot reopened this Dec 8, 2024
@renovate renovate bot force-pushed the renovate/npm-intlify-shared-vulnerability branch from 8faa648 to 04eefdc Compare December 8, 2024 22:00
@renovate renovate bot force-pushed the renovate/npm-intlify-shared-vulnerability branch from 04eefdc to e836036 Compare January 23, 2025 17:02
@renovate renovate bot force-pushed the renovate/npm-intlify-shared-vulnerability branch from e836036 to baa4af1 Compare February 9, 2025 13:34
@renovate renovate bot force-pushed the renovate/npm-intlify-shared-vulnerability branch from baa4af1 to 0e07940 Compare March 11, 2025 12:25
@renovate renovate bot force-pushed the renovate/npm-intlify-shared-vulnerability branch from 0e07940 to d86190e Compare April 8, 2025 11:51
@renovate renovate bot force-pushed the renovate/npm-intlify-shared-vulnerability branch from d86190e to b9542dd Compare May 28, 2025 12:54
@renovate renovate bot force-pushed the renovate/npm-intlify-shared-vulnerability branch from b9542dd to 0e9a8b0 Compare June 22, 2025 14:49
@renovate renovate bot force-pushed the renovate/npm-intlify-shared-vulnerability branch from 0e9a8b0 to 578b4cb Compare July 2, 2025 15:57
@renovate renovate bot force-pushed the renovate/npm-intlify-shared-vulnerability branch from 578b4cb to 77e748b Compare August 10, 2025 14:27
@renovate renovate bot force-pushed the renovate/npm-intlify-shared-vulnerability branch from 77e748b to 93b3fa0 Compare September 25, 2025 16:26
@renovate renovate bot changed the title fix(deps): update dependency @intlify/shared to v9.14.2 [security] chore(deps): update dependency @intlify/shared to v9.14.2 [security] Sep 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Type: Dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants