Function Call Object Injection Sink
ps-vm opened this issue · comments
Please help prevent duplicate issues before submitting a new one:
- [ x] I've searched other open/closed issues for duplicates before opening up this new issue.
Report
Our SAST report picked up a critical vulnerability within this library
- "Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype, leading to possible code execution."
What did you do?
Configured SAST to run within GitLab pipelines for our iOS project.
What did you expect to happen?
No critical vulnerabilities
What happened instead?
One critical vulnerability related to this library has been flagged in the highlight.js file.
We're on the latest version of this library and need to be able to reduce all critical and high vulnerabilities in order to ensure we're releasing secure products.