GHSA-4gxf-g5gf-22h4

Suggest an improvement
Source
https://github.com/advisories/GHSA-4gxf-g5gf-22h4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-4gxf-g5gf-22h4/GHSA-4gxf-g5gf-22h4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4gxf-g5gf-22h4
Aliases
Published
2023-06-10T06:30:25Z
Modified
2023-11-08T04:11:59.312591Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
dottie vulnerable to Prototype Pollution
Details

Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.

Database specific 
{
    "severity": "HIGH",
    "github_reviewed_at": "2023-06-12T18:34:39Z",
    "cwe_ids": [
        "CWE-1321"
    ],
    "nvd_published_at": "2023-06-10T05:15:08Z",
    "github_reviewed": true
}
References

Affected packages

npm / dottie

Package

Name
dottie
View open source insights on deps.dev
Purl
pkg:npm/dottie

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-4gxf-g5gf-22h4/GHSA-4gxf-g5gf-22h4.json"