What is GHSA-jjff-q3q4-5hh8?

GHSA-jjff-q3q4-5hh8 is a security advisory published by GitHub Security Advisories with Critical severity. @andrei-tatar/nora-firebase-common Prototype Pollution vulnerability

Which CVE IDs does GHSA-jjff-q3q4-5hh8 cover?

GHSA-jjff-q3q4-5hh8 covers the following CVE IDs: CVE-2024-30564. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jjff-q3q4-5hh8?

GHSA-jjff-q3q4-5hh8 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-jjff-q3q4-5hh8?

GHSA-jjff-q3q4-5hh8 affects 1 product, including: npm/@andrei-tatar/nora-firebase-common:\u003e= 1.0.41, \u003c 1.12.3.

GHSA-jjff-q3q4-5hh8CriticalCVSS 9.8

@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability

Vendor

GitHub Security Advisories

Published

April 18, 2024

Last Modified

June 11, 2026

🔗 CVE IDs covered (1)

CVE-2024-30564 →

📋 Description

An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method.

🎯 Affected products1

npm/@andrei-tatar/nora-firebase-common:>= 1.0.41, < 1.12.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-30564
https://github.com/andrei-tatar/nora-firebase-common/issues/9
https://github.com/andrei-tatar/nora-firebase-common/commit/bf30b75d51be04f6c1f884561a223226c890f01b
https://gist.github.com/mestrtee/5dc2c948c2057f98d3de0a9790903c6c
https://github.com/advisories/GHSA-jjff-q3q4-5hh8