diegohaz/bodymen · Security
Prototype Pollution in bodymen
- GHSA ID
- GHSA-vhxc-fhm5-qcp9
- CVE ID
- CVE-2022-25296
- Severity
- medium
- Published
- Updated
- CVSS
- 6.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CVSS v3
- 6.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Description
The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a proto payload. Note: This vulnerability derives from an incomplete fix to CVE-2019-10792
CWEs
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')