GHSA-r659-8xfp-j327

Source

https://github.com/advisories/GHSA-r659-8xfp-j327

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-r659-8xfp-j327/GHSA-r659-8xfp-j327.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r659-8xfp-j327

Aliases

CVE-2021-3766

Published

2021-09-07T23:09:43Z

Modified

2023-11-08T04:06:20Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

objection.js Prototype Pollution vulnerability

Details

objection.js prior to version 2.2.16 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). This issue is patched in version 2.2.16.

Database specific

{
    "cwe_ids":  [
        "CWE-1321",
        "CWE-915"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-09-07T19:01:54Z",
    "nvd_published_at":  "2021-09-06T12:15:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

npm / objection

Package

Name: objection; View open source insights on deps.dev
Purl: pkg:npm/objection

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.2.16

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-r659-8xfp-j327/GHSA-r659-8xfp-j327.json"