What is GHSA-8qpm-5c82-rf96?

GHSA-8qpm-5c82-rf96 is a security advisory published by GitHub Security Advisories with High severity. Prototype Pollution in backbone-query-parameters

Which CVE IDs does GHSA-8qpm-5c82-rf96 cover?

GHSA-8qpm-5c82-rf96 covers the following CVE IDs: CVE-2021-20085. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8qpm-5c82-rf96?

GHSA-8qpm-5c82-rf96 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-8qpm-5c82-rf96?

GHSA-8qpm-5c82-rf96 affects 1 product, including: npm/backbone-query-parameters:\u003c= 0.4.0.

GHSA-8qpm-5c82-rf96HighCVSS 8.8

Prototype Pollution in backbone-query-parameters

Vendor

GitHub Security Advisories

Published

May 6, 2021

Last Modified

August 8, 2023

🔗 CVE IDs covered (1)

CVE-2021-20085 →

📋 Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.

🎯 Affected products1

npm/backbone-query-parameters:<= 0.4.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2021-20085
https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/backbone-qp.md
https://github.com/advisories/GHSA-8qpm-5c82-rf96