Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

WS-2021-0204

Good to know:

icon
icon
icon

Date: November 3, 2024

An issue was found in the "think-config" NPM package before v1.1.3 . The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Language: JS

Severity Score

Related Resources (4)

https://github.com/thinkjs/think-config/security/advisories/GHSA-6cj2-92m5-7mvp
https://github.com/thinkjs/think-config
https://github.com/thinkjs/think-config/commit/31b82468d72f2e1456a27a4827cea378196db6db
https://www.mend.io/vulnerability-database/WS-2021-0204

Severity Score

Weakness Type (CWE)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

icon

Upgrade Version

Upgrade to version think-config - 1.1.3

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us