cronvel/tree-kit · Security
tree-kit Prototype Pollution vulnerability
- GHSA ID
- GHSA-5p42-m6f3-hpmj
- CVE ID
- CVE-2023-38894
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.
CWEs
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-38894 ↗
- https://www.code-intelligence.com/blog/treekit-prototype-pollution-cve-2023-38894 ↗
- https://github.com/cronvel/tree-kit/commit/61bf10cf0dbddaeea3f198cfe7cb469f360d82bc ↗
- https://github.com/cronvel/tree-kit ↗
- http://tree-kit.com ↗
- https://github.com/advisories/GHSA-5p42-m6f3-hpmj ↗