GitHub Advisoryadvisory · npm

GHSA-g3q2-vcjq-rgrc Blackprint @blackprint/engine Prototype Pollution issue

CRITICAL Published 2024-05-20 Modified 2024-07-05 Official page ↗
Aliases
CVE-2024-24294
Ecosystem
npm
Packages
@blackprint/engine
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321, CWE-94
Reviewed
2024-05-20

Affected packages

• npm @blackprint/engine: >= 0.8.12, < 0.9.2 → fixed in 0.9.2

Description

A Prototype Pollution issue in Blackprint @blackprint/engine 0.8.12 through 0.9.1 allows an attacker to execute arbitrary code via the `_utils.setDeepProperty` function of `engine.min.js`.

Related

Alias · CVE (1)

  • CVE-2024-24294 A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the… vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-94 Improper Control of Generation of Code weakness

References