What is GHSA-f98m-q3hr-p5wq?

GHSA-f98m-q3hr-p5wq is a security advisory published by GitHub Security Advisories with Critical severity. Prototype Pollution in locutus

Which CVE IDs does GHSA-f98m-q3hr-p5wq cover?

GHSA-f98m-q3hr-p5wq covers the following CVE IDs: CVE-2020-7719. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f98m-q3hr-p5wq?

GHSA-f98m-q3hr-p5wq has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-f98m-q3hr-p5wq?

GHSA-f98m-q3hr-p5wq affects 1 product, including: npm/locutus:\u003c 2.0.12.

GHSA-f98m-q3hr-p5wqCriticalCVSS 9.8

Prototype Pollution in locutus

Vendor

GitHub Security Advisories

Published

May 6, 2021

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2020-7719 →

📋 Description

All versions of package locutus prior to version 2.0.12 are vulnerable to Prototype Pollution via the php.strings.parse_str function.

🎯 Affected products1

npm/locutus:< 2.0.12

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-7719
https://github.com/kvz/locutus/pull/418/
https://github.com/locutusjs/locutus/commit/0eb16d8541838e80f3c2340a9ef93ded7c97290f
https://snyk.io/vuln/SNYK-JS-LOCUTUS-598675
https://github.com/advisories/GHSA-f98m-q3hr-p5wq