GitHub Advisoryadvisory · npm

GHSA-ph28-wwfj-fv7f Prototype Pollution in sds

HIGH Published 2022-05-14 Modified 2022-05-25 Official page ↗
Aliases
CVE-2022-25862
Ecosystem
npm
Packages
sds
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1321
Reviewed
2022-05-25

Affected packages

• npm sds: <= 4.4.0 (no fix yet)

Description

This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. Note: This vulnerability derives from an incomplete fix to CVE-2020-7618

Related

Alias · CVE (1)

  • CVE-2022-25862 This affects the package sds from 0.0.0. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References