What is GHSA-hxcm-v35h-mg2x?

GHSA-hxcm-v35h-mg2x is a security advisory published by GitHub Security Advisories with High severity. Prototype Pollution in querystringify

Why does GHSA-hxcm-v35h-mg2x have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-hxcm-v35h-mg2x?

GHSA-hxcm-v35h-mg2x affects 1 product, including: npm/querystringify:\u003c 2.0.0.

GHSA-hxcm-v35h-mg2xHighDisclosed before NVD

Prototype Pollution in querystringify

Vendor

GitHub Security Advisories

Published

June 7, 2019

Last Modified

November 29, 2023

📋 Description

A vulnerability was found in querystringify before 2.0.0. It's possible to override built-in properties of the resulting query string object if a malicious string is inserted in the query string.

🎯 Affected products1

npm/querystringify:< 2.0.0

🔗 References (3)

https://github.com/unshiftio/querystringify/pull/19
https://github.com/unshiftio/querystringify/commit/422eb4f6c7c28ee5f100dcc64177d3b68bb2b080
https://github.com/advisories/GHSA-hxcm-v35h-mg2x