GitHub Advisoryadvisory · npm

GHSA-x3m3-4wpv-5vgc jrburke requirejs vulnerable to prototype pollution

HIGH Published 2024-07-01 Modified 2024-07-25 Official page ↗
Aliases
CVE-2024-38999
Ecosystem
npm
Packages
requirejs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2024-07-10

Affected packages

• npm requirejs: < 2.3.7 → fixed in 2.3.7

Description

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function `s.contexts._.configure`. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Related

Alias · CVE (1)

  • CVE-2024-38999 jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References