GitHub Advisoryadvisory · npm
GHSA-7wpw-2hjm-89gp Prototype Pollution in merge
HIGH
Official page ↗
- Aliases
- CVE-2020-28499
- Ecosystem
- npm
- Packages
- merge
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-915
- Reviewed
- 2021-03-18
Affected packages
• npm merge: < 2.1.1 → fixed in 2.1.1
Description
All versions of package merge <2.1.1 are vulnerable to Prototype Pollution via _recursiveMerge .
Related
Alias · CVE (1)
- CVE-2020-28499 All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge . vulnerability
Weakness · CWE (1)
- CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-28499 advisory
- https://github.com/yeikos/js.merge/commit/7b0ddc2701d813f2ba289b32d6a4b9d4cc235fb4 web
- https://github.com/yeikos/js.merge/blob/56ca75b2dd0f2820f1e08a49f62f04bbfb8c5f8f/src/index.ts#L64 web
- https://github.com/yeikos/js.merge/blob/master/src/index.ts#L64 web
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1071049 web
- https://snyk.io/vuln/SNYK-JS-MERGE-1042987 web
- https://vuldb.com/?id.170146 web