What is GHSA-v26w-gcxh-v4r7?

GHSA-v26w-gcxh-v4r7 is a security advisory published by GitHub Security Advisories with Critical severity. Prototype polluation in just-safe-set

Which CVE IDs does GHSA-v26w-gcxh-v4r7 cover?

GHSA-v26w-gcxh-v4r7 covers the following CVE IDs: CVE-2021-25952. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v26w-gcxh-v4r7?

GHSA-v26w-gcxh-v4r7 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-v26w-gcxh-v4r7?

GHSA-v26w-gcxh-v4r7 affects 1 product, including: npm/just-safe-set:\u003e= 1.0.0, \u003c 2.2.2.

GHSA-v26w-gcxh-v4r7CriticalCVSS 9.8

Prototype polluation in just-safe-set

Vendor

GitHub Security Advisories

Published

December 10, 2021

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-25952 →

📋 Description

Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.

🎯 Affected products1

npm/just-safe-set:>= 1.0.0, < 2.2.2

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-25952
https://github.com/angus-c/just/pull/267
https://github.com/angus-c/just/commit/dd57a476f4bb9d78c6f60741898dc04c71d2eb53
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25952
https://github.com/advisories/GHSA-v26w-gcxh-v4r7