Vulnerability Report - @socket.io__component-emitter

[dfzysmy2tf-create]

hi, we are a security team. We found a Prototype Pollution vulnerability in your project.
Vulnerability Type: Prototype Pollution
Vulnerability Cause: An attacker can construct a malicious object with the _callbacks property pointing explicitly to Object.prototype. When this object is mixed into Emitter() and the on() method is called, the assignment this._callbacks['$' + event] = ... writes directly to Object.prototype, causing global prototype pollution.
Affected Code Location: package/package/lib/cjs/index.js:45
POC Payload:

{ _callbacks: Object.prototype } with event argument 'polluted'

POC Call Code:

const maliciousObj = { _callbacks: Object.prototype };
const emitter = Emitter(maliciousObj);
emitter.on('polluted', function() {});

Verification Output:

[CASE_ID=TP0002] [VULN_BOTH] Global and local prototype pollution via _callbacks manipulation

[darrachequesne]

Hi! I think you are looking for https://github.com/socketio/socket.io/tree/main/packages/socket.io-component-emitter.

I don't think the mixin() method is used anywhere, could you please check?