GitHub Advisoryadvisory · npm

GHSA-77xq-cpvg-7xm2 Prototype pollution in @tsed/core

MEDIUM Published 2021-05-10 Modified 2023-09-05 Official page ↗
Aliases
CVE-2020-7748
Ecosystem
npm
Packages
@tsed/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-04-20

Affected packages

• npm @tsed/core: < 5.65.7 → fixed in 5.65.7

Description

This affects the package @tsed/core before 5.65.7. This vulnerability relates to the `deepExtend` function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

Related

Alias · CVE (1)

  • CVE-2020-7748 This affects the package @tsed/core before 5.65.7. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References