What is GHSA-wfwq-xc57-fq7v?

GHSA-wfwq-xc57-fq7v is a security advisory published by GitHub Security Advisories with Medium severity. eivindfjeldstad-dot contains prototype pollution vulnerability

Which CVE IDs does GHSA-wfwq-xc57-fq7v cover?

GHSA-wfwq-xc57-fq7v covers the following CVE IDs: CVE-2020-7639. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wfwq-xc57-fq7v?

GHSA-wfwq-xc57-fq7v has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-wfwq-xc57-fq7v?

GHSA-wfwq-xc57-fq7v affects 1 product, including: npm/@eivifj/dot:\u003c 1.0.3.

GHSA-wfwq-xc57-fq7vMediumCVSS 5.3

eivindfjeldstad-dot contains prototype pollution vulnerability

Vendor

GitHub Security Advisories

Published

May 25, 2021

Last Modified

July 13, 2023

🔗 CVE IDs covered (1)

CVE-2020-7639 →

📋 Description

eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload.

🎯 Affected products1

npm/@eivifj/dot:< 1.0.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-7639
https://github.com/eivindfjeldstad/dot/commit/774e4b0c97ca35d2ae40df2cd14428d37dd07a0b
https://snyk.io/vuln/SNYK-JS-EIVIFJDOT-564435
https://github.com/advisories/GHSA-wfwq-xc57-fq7v