Prototype pollution in function consolidate.teacup.render #349
Description
Affected versions of this package are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.Consolidate runs the risk of Prototype Pollution when using the function teacup.render. The function use vm and coffee.compile lead an attacker to modify properties of the Object.prototype.
the risk locate is in here
consolidate.js/lib/consolidate.js
Line 1756 in ec2e1ae
and the POC is as follow：
var consolidate = require("consolidate")
console.log({}.test)
consolidate.teacup.render("proto.test=123")
console.log({}.test) //123
the function teacup.render in the file consolidate/lib/consolidate.js in the line L1756, by using the vm,change the Object.prototype.you didn't have the protection or identify whether the object maybe polluted,so if an attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.