remote-git-tags

Hi, we are a security team. We found a prototype pollution vulnerability in your project. The issue affects . The vulnerable behavior happens when tag names from an attacker-controlled remote repository are used as dynamic property keys while building the result object. If the remote repository contains a tag named , prototype pollution may occur. Impact An attacker controlling the remote repository may be able to change the prototype of the returned object in the affected runtime. Proof of concept Details We confirmed the following case: sink: The root cause is that untrusted tag names can flow into dynamic property writes without blocking special prototype-related keys.

Adds typescript types