What is GHSA-g3q2-vcjq-rgrc?

GHSA-g3q2-vcjq-rgrc is a security advisory published by GitHub Security Advisories with Critical severity. Blackprint @blackprint/engine Prototype Pollution issue

Which CVE IDs does GHSA-g3q2-vcjq-rgrc cover?

GHSA-g3q2-vcjq-rgrc covers the following CVE IDs: CVE-2024-24294. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g3q2-vcjq-rgrc?

GHSA-g3q2-vcjq-rgrc has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-g3q2-vcjq-rgrc?

GHSA-g3q2-vcjq-rgrc affects 1 product, including: npm/@blackprint/engine:\u003e= 0.8.12, \u003c 0.9.2.

GHSA-g3q2-vcjq-rgrcCriticalCVSS 9.8

Blackprint @blackprint/engine Prototype Pollution issue

Vendor

GitHub Security Advisories

Published

May 20, 2024

Last Modified

July 5, 2024

🔗 CVE IDs covered (1)

CVE-2024-24294 →

📋 Description

A Prototype Pollution issue in Blackprint @blackprint/engine 0.8.12 through 0.9.1 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.

🎯 Affected products1

npm/@blackprint/engine:>= 0.8.12, < 0.9.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-24294
https://gist.github.com/mestrtee/d1eb6e1f7c6dd60d8838c3e56cab634d
https://github.com/Blackprint/engine-js/commit/bd6b965b03c467e7a58ab0cb89b9172fa5e07013
https://github.com/advisories/GHSA-g3q2-vcjq-rgrc