What is GHSA-7wpw-2hjm-89gp?

GHSA-7wpw-2hjm-89gp is a security advisory published by GitHub Security Advisories with High severity. Prototype Pollution in merge

Which CVE IDs does GHSA-7wpw-2hjm-89gp cover?

GHSA-7wpw-2hjm-89gp covers the following CVE IDs: CVE-2020-28499. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7wpw-2hjm-89gp?

GHSA-7wpw-2hjm-89gp has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

Which products are affected by GHSA-7wpw-2hjm-89gp?

GHSA-7wpw-2hjm-89gp affects 1 product, including: npm/merge:\u003c 2.1.1.

GHSA-7wpw-2hjm-89gpHighCVSS 7.3

Prototype Pollution in merge

Vendor

GitHub Security Advisories

Published

May 4, 2021

Last Modified

February 13, 2024

🔗 CVE IDs covered (1)

CVE-2020-28499 →

📋 Description

All versions of package merge <2.1.1 are vulnerable to Prototype Pollution via _recursiveMerge .

🎯 Affected products1

npm/merge:< 2.1.1

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2020-28499
https://github.com/yeikos/js.merge/commit/7b0ddc2701d813f2ba289b32d6a4b9d4cc235fb4
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1071049
https://snyk.io/vuln/SNYK-JS-MERGE-1042987
https://vuldb.com/?id.170146
https://github.com/yeikos/js.merge/blob/56ca75b2dd0f2820f1e08a49f62f04bbfb8c5f8f/src/index.ts#L64
https://github.com/yeikos/js.merge/blob/master/src/index.ts#L64
https://github.com/advisories/GHSA-7wpw-2hjm-89gp