GitHub Advisoryadvisory · npm

GHSA-p3pg-64pv-v7jg Prototype Pollution in jsgui-lang-essentials

HIGH Published 2022-05-03 Modified 2022-05-20 Official page ↗
Aliases
CVE-2022-25301
Ecosystem
npm
Packages
jsgui-lang-essentials
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2022-05-20

Affected packages

• npm jsgui-lang-essentials: <= 0.4.3 (no fix yet)

Description

All versions of package `jsgui-lang-essentials` are vulnerable to Prototype Pollution due to allowing all `Object` attributes to be altered, including their magical attributes such as `proto`, `constructor` and `prototype`.

Related

Alias · CVE (1)

  • CVE-2022-25301 All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered,… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References