What is GHSA-rrqm-p222-8ph2?

GHSA-rrqm-p222-8ph2 is a security advisory published by GitHub Security Advisories with High severity. Prototype Pollution in Dynamoose

Which CVE IDs does GHSA-rrqm-p222-8ph2 cover?

GHSA-rrqm-p222-8ph2 covers the following CVE IDs: CVE-2021-21304. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rrqm-p222-8ph2?

GHSA-rrqm-p222-8ph2 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-rrqm-p222-8ph2?

GHSA-rrqm-p222-8ph2 affects 1 product, including: npm/dynamoose:\u003e= 2.0.0, \u003c 2.7.0.

GHSA-rrqm-p222-8ph2HighCVSS 7.2

Prototype Pollution in Dynamoose

Vendor

GitHub Security Advisories

Published

February 8, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-21304 →

📋 Description

Impact

In Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method lib/utils/object/set.ts. This method is used throughout the codebase for various operations throughout Dynamoose.

We have not seen any evidence of this vulnerability being exploited.

We do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.

Patches

v2.7.0 includes a patch for this vulnerability.

Workarounds

We are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.

References

Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e

For more information

If you have any questions or comments about this advisory:

Credit

GitHub CodeQL Code Scanning

🎯 Affected products1

npm/dynamoose:>= 2.0.0, < 2.7.0