What is GHSA-mjjj-6p43-vhhv?

GHSA-mjjj-6p43-vhhv is a security advisory published by GitHub Security Advisories with High severity. Prototype Pollution in deep-get-set

Which CVE IDs does GHSA-mjjj-6p43-vhhv cover?

GHSA-mjjj-6p43-vhhv covers the following CVE IDs: CVE-2022-21231. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mjjj-6p43-vhhv?

GHSA-mjjj-6p43-vhhv has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-mjjj-6p43-vhhv?

GHSA-mjjj-6p43-vhhv affects 1 product, including: npm/deep-get-set:\u003c= 1.1.1.

GHSA-mjjj-6p43-vhhvHighCVSS 7.5

Prototype Pollution in deep-get-set

Vendor

GitHub Security Advisories

Published

June 25, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-21231 →

📋 Description

All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715

🎯 Affected products1

npm/deep-get-set:<= 1.1.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-21231
https://snyk.io/vuln/SNYK-JS-DEEPGETSET-2342655
https://github.com/advisories/GHSA-mjjj-6p43-vhhv