cve/2024/CVE-2024-32866.md

### [CVE-2024-32866](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32866)
![](https://img.shields.io/static/v1?label=Product&message=conform&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%201.1.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1321%3A%20Improperly%20Controlled%20Modification%20of%20Object%20Prototype%20Attributes%20('Prototype%20Pollution')&color=brighgreen)

### Description

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.

### POC

#### Reference
- https://github.com/edmundhung/conform/security/advisories/GHSA-624g-8qjg-8qxf
- https://github.com/edmundhung/conform/security/advisories/GHSA-624g-8qjg-8qxf

#### Github
No PoCs found on GitHub currently.