GitHub Advisoryadvisory · npm

GHSA-6c8f-qphg-qjgp Validation Bypass in kind-of

HIGH Published 2020-03-31 Modified 2021-08-23 Official page ↗
Aliases
CVE-2019-20149
Ecosystem
npm
Packages
kind-of
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-668
Reviewed
2020-03-31

Affected packages

• npm kind-of: >= 6.0.0, < 6.0.3 → fixed in 6.0.3

Description

Versions of `kind-of` 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. Recommendation Upgrade to versions 6.0.3 or later.

Related

Alias · CVE (1)

  • CVE-2019-20149 ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as… vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References