GitStock

oven-sh/bun · Security

Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

Open GitHub
GHSA ID
GHSA-v9mx-4pqq-h232
CVE ID
CVE-2024-21548
Severity
medium
Published
Updated
CVSS
7.5 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3
7.5 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4
6.8 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Description

Versions of the package bun before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects.

CWEs

  • CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

References