jQuery – Prototype Pollution Vulnerability Under 3.4.0

Impact Area

Security

 

 

 

Severity

High

 

 

 

Affected Element

ServiceNow

UI Script

Salesforce

Static Resource

Rule number #

SN-JSL-010 (for ServiceNow)

SF-JSL-010 (for Salesforce)

Impact #

jQuery before 3.4.0 mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

Remediation #

Update jQuery to the latest version.

Time to fix #

30 min

Was it helpful ?
Table of contents

THE AI CODE GOVERNANCE BRIEF

Sign up for new updates!
ServiceNow
Salesforce