What is GHSA-r659-8xfp-j327?

GHSA-r659-8xfp-j327 is a security advisory published by GitHub Security Advisories with Critical severity. objection.js Prototype Pollution vulnerability

Which CVE IDs does GHSA-r659-8xfp-j327 cover?

GHSA-r659-8xfp-j327 covers the following CVE IDs: CVE-2021-3766. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r659-8xfp-j327?

GHSA-r659-8xfp-j327 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-r659-8xfp-j327?

GHSA-r659-8xfp-j327 affects 1 product, including: npm/objection:\u003c 2.2.16.

GHSA-r659-8xfp-j327CriticalCVSS 9.8

objection.js Prototype Pollution vulnerability

Vendor

GitHub Security Advisories

Published

September 7, 2021

Last Modified

September 7, 2023

🔗 CVE IDs covered (1)

CVE-2021-3766 →

📋 Description

objection.js prior to version 2.2.16 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). This issue is patched in version 2.2.16.

🎯 Affected products1

npm/objection:< 2.2.16

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-3766
https://github.com/vincit/objection.js/commit/b41aab8dcd78f426f7468dcda541a7aca18a66a6
https://huntr.dev/bounties/c98e0f0e-ebf2-4072-be73-a1848ea031cc
https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9
https://github.com/advisories/GHSA-r659-8xfp-j327