Vulnerability in "kind-of" found in package-lock.json

[schubon]

Details

CVE-2019-20149

moderate severity
Vulnerable versions: < 6.0.3
Patched version: 6.0.3

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Remediation

Upgrade kind-of to version 6.0.3 or later. For example:

"dependencies": {
  "kind-of": ">=6.0.3"
}

or…

"devDependencies": {
  "kind-of": ">=6.0.3"
}

Always verify the validity and compatibility of suggestions with your codebase.