GHSA-c4w7-xm78-47vh
Suggest an improvement- Source
- https://github.com/advisories/GHSA-c4w7-xm78-47vh
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-c4w7-xm78-47vh/GHSA-c4w7-xm78-47vh.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-c4w7-xm78-47vh
- Aliases
- Published
- 2021-03-29T16:05:12Z
- Modified
- 2024-12-05T15:28:53.812442Z
- Severity
-
- 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- Prototype Pollution in y18n
- Details
-
Overview
The npm package
y18nbefore versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.POC
const y18n = require('y18n')(); y18n.setLocale('__proto__'); y18n.updateLocale({polluted: true}); console.log(polluted); // trueRecommendation
Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.
- Database specific
{ "nvd_published_at": "2020-11-17T13:15:00Z", "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-1321", "CWE-20", "CWE-915" ], "github_reviewed_at": "2021-03-12T21:23:11Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2020-7774
- https://github.com/yargs/y18n/issues/96
- https://github.com/yargs/y18n/pull/108
- https://github.com/yargs/y18n/commit/90401eea9062ad498f4f792e3fff8008c4c193a3
- https://github.com/yargs/y18n/commit/a9ac604abf756dec9687be3843e2c93bfe581f25
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://github.com/yargs/y18n
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306
- https://snyk.io/vuln/SNYK-JS-Y18N-1021887
- https://www.oracle.com/security-alerts/cpuApr2021.html
Affected packages
npm / y18n
Package
- Name
- y18n
- View open source insights on deps.dev
- Purl
- pkg:npm/y18n
npm / y18n
Package
- Name
- y18n
- View open source insights on deps.dev
- Purl
- pkg:npm/y18n
npm / y18n
Package
- Name
- y18n
- View open source insights on deps.dev
- Purl
- pkg:npm/y18n