GHSA-9fp7-4fjm-q3mf

Source

https://github.com/advisories/GHSA-9fp7-4fjm-q3mf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-9fp7-4fjm-q3mf/GHSA-9fp7-4fjm-q3mf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9fp7-4fjm-q3mf

Aliases

CVE-2021-23760

Published

2022-02-01T00:51:01Z

Modified

2023-11-08T04:05:13Z

Severity

5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Prototype Pollution in keyget

Details

The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. Note: This vulnerability derives from an incomplete fix to CVE-2020-28272

Database specific

{
    "cwe_ids": [
        "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-31T19:46:10Z",
    "nvd_published_at": "2022-01-28T22:15:00Z",
    "severity": "MODERATE"
}

References

Affected packages

npm / keyget

Package

Name: keyget; View open source insights on deps.dev
Purl: pkg:npm/keyget

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2.4.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-9fp7-4fjm-q3mf/GHSA-9fp7-4fjm-q3mf.json"