GitHub Advisoryadvisory · npm

GHSA-93q5-3xpc-8vg3 steal vulnerable to Prototype Pollution via requestedVersion variable

CRITICAL Published 2022-09-16 Modified 2022-09-21 Official page ↗
Aliases
CVE-2022-37257
Ecosystem
npm
Packages
steal
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2022-09-21

Affected packages

• npm steal: <= 2.3.0 (no fix yet)

Description

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal via the requestedVersion variable in the npm-convert.js file.

Related

Alias · CVE (1)

  • CVE-2022-37257 Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References