Prototype pollution in function consolidate.teacup.render

[lelecolacola123]

Affected versions of this package are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.Consolidate runs the risk of Prototype Pollution when using the function teacup.render. The function use vm and coffee.compile lead an attacker to modify properties of the Object.prototype.
the risk locate is in here

consolidate.js/lib/consolidate.js

Line 1756 in ec2e1ae

vm.runInNewContext(coffee.compile(str), sandbox);

and the POC is as follow：
var consolidate = require("consolidate")
console.log({}.test)
consolidate.teacup.render("proto.test=123")
console.log({}.test) //123

the function teacup.render in the file consolidate/lib/consolidate.js in the line L1756, by using the vm,change the Object.prototype.you didn't have the protection or identify whether the object maybe polluted,so if an attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.

[titanism]

We have forked this repository for maintenance and released it under @ladjs/consolidate, see https://github.com/ladjs/consolidate.js. We have merged PR's and updated it for email-templates. Please click the "Watch" button to get notified of all releases at https://github.com/ladjs/consolidate.js. Thank you 🙏

[justinvforvendetta]

@titanism where can we find the sha512 for the new releases like 1.1.3? thanks!

[harryzcy]

@titanism Can you enable issues on your fork? thanks