GHSA-58g2-9fqr-36q2

Source

https://github.com/advisories/GHSA-58g2-9fqr-36q2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-58g2-9fqr-36q2/GHSA-58g2-9fqr-36q2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-58g2-9fqr-36q2

Aliases

CVE-2021-23426

Published

2021-09-02T22:01:01Z

Modified

2023-11-08T04:05:08Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Prototype Pollution in Proto

Details

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.

Database specific

{
    "cwe_ids":  [
        "CWE-1321"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-09-02T17:04:55Z",
    "nvd_published_at":  "2021-09-01T15:15:00Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / Proto

Package

Name: Proto; View open source insights on deps.dev
Purl: pkg:npm/Proto

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.1.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-58g2-9fqr-36q2/GHSA-58g2-9fqr-36q2.json"