GHSA-v9mx-4pqq-h232MediumCVSS 7.5

Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

Published
December 18, 2024
Last Modified
July 24, 2025

🔗 CVE IDs covered (1)

CVE-2024-21548 →

📋 Description

Versions of the package bun before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects.

🎯 Affected products1

  • npm/bun:> 0.0.12, < 1.1.30

🔗 References (5)