What is GHSA-qj86-v6m7-4qv2?

GHSA-qj86-v6m7-4qv2 is a security advisory published by GitHub Security Advisories with High severity. Object Resolver Prototype Pollution

Which CVE IDs does GHSA-qj86-v6m7-4qv2 cover?

GHSA-qj86-v6m7-4qv2 covers the following CVE IDs: CVE-2024-36577. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qj86-v6m7-4qv2?

GHSA-qj86-v6m7-4qv2 has a CVSS v3 base score of 8.3, published by GitHub Security Advisories.

Which products are affected by GHSA-qj86-v6m7-4qv2?

GHSA-qj86-v6m7-4qv2 affects 1 product, including: npm/@apphp/object-resolver:\u003c 3.1.1.

GHSA-qj86-v6m7-4qv2HighCVSS 8.3

Object Resolver Prototype Pollution

Vendor

GitHub Security Advisories

Published

June 17, 2024

Last Modified

July 5, 2024

🔗 CVE IDs covered (1)

CVE-2024-36577 →

📋 Description

apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.

🎯 Affected products1

npm/@apphp/object-resolver:< 3.1.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-36577
https://gist.github.com/mestrtee/c90189f3d8480a5f267395ec40701373
https://github.com/apphp/js-object-resolver/commit/7e347a26bf04d6a4f7525f6605666afbb218afca
https://github.com/advisories/GHSA-qj86-v6m7-4qv2