[GHSA-gvwq-6fmx-28xm] node-opcua-alarm-condition prototype pollution vulnerability

[tariqhawis]

Updates

• CVSS v3
• References
• Severity

Comments
Removed an issue link unrelated to the vulnerability.
Details: the removed issue link is opened by a user to confirm the status of the vulnerability, which is already fixed b y the maintainer based on our original private report in Nov, 2024.
The credited user should be replaced by the original one (tariqhawis).

[Copilot]

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• advisories/github-reviewed/2025/02/GHSA-gvwq-6fmx-28xm/GHSA-gvwq-6fmx-28xm.json: Language not supported

[shelbyc]

Hi @tariqhawis, the other person has credit on GHSA-gvwq-6fmx-28xm for #5448, which added a reference link that indicated that the issue was fixed in version 2.137.0. If that information is correct, then the other person should still have credit.

Reporter/finder/anything other than analyst credit is only available on advisories that are sourced from repository GitHub Security Advisories, and those credits are provided by the repository maintainers. GHSA-gvwq-6fmx-28xm is sourced from NVD, so the only credits available are analyst credits from community contributions. Many reporters get credit on advisories by enhancing the advisories with information from their initial vulnerability reports, so that the advisory description contains more than the text of the CVE record.

I have some questions about your contribution:

• Did you intend to remove Asking if CVE-2024-57086 is already fixed? node-opcua/node-opcua#1433 (comment) because the issue is fixed in a version prior to 2.137.0? If so, what is the first fixed version?
• I noticed that the PR recommends changing the CVSS from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H. Is the change based on the following text from your vulnerability report?:

Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.

If so, do you consent to changing the CVSS in the advisory and having this text from your vulnerability report appear in the description of GHSA-gvwq-6fmx-28xm, which would result in having analyst credit added for you to GHSA-gvwq-6fmx-28xm?