What is GHSA-f9cm-qmx5-m98h?

GHSA-f9cm-qmx5-m98h is a security advisory published by GitHub Security Advisories with High severity. Prototype Pollution in merge

Which CVE IDs does GHSA-f9cm-qmx5-m98h cover?

GHSA-f9cm-qmx5-m98h covers the following CVE IDs: CVE-2018-16469. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f9cm-qmx5-m98h?

GHSA-f9cm-qmx5-m98h has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-f9cm-qmx5-m98h?

GHSA-f9cm-qmx5-m98h affects 1 product, including: npm/merge:\u003c 1.2.1.

GHSA-f9cm-qmx5-m98hHighCVSS 7.5

Prototype Pollution in merge

Vendor

GitHub Security Advisories

Published

November 1, 2018

Last Modified

September 7, 2023

🔗 CVE IDs covered (1)

CVE-2018-16469 →

📋 Description

Versions of merge before 1.2.1 are vulnerable to prototype pollution. The merge.recursive function can be tricked into adding or modifying properties of the Object prototype.

Recommendation

Update to version 1.2.1 or later.

🎯 Affected products1

npm/merge:< 1.2.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-16469
https://hackerone.com/reports/381194
https://github.com/advisories/GHSA-f9cm-qmx5-m98h
https://www.npmjs.com/advisories/722