nestjs-config-lodash.set-vuln

Repository to demonstrate that the @nestjs/config has a vulnerable dependency

Snyk vulnerability bulletin: https://security.snyk.io/vuln/SNYK-JS-LODASHSET-1320032 Original HackerOne report for the lodash package: https://hackerone.com/reports/864701

Instructions to replicate vulnerability:

• Install dependecies with npm install
  • Note that the only dependency is the @nestjs/config package
• Run index.js with node index.js
• Results show that the lodash.set package contains the Prototype Pollution vulnerability