wollardj/simple-plist · Security
Prototype Pollution in simple-plist
- GHSA ID
- GHSA-gff7-g5r8-mg8m
- CVE ID
- CVE-2022-26260
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
simple-plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().
CWEs
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-26260 ↗
- https://github.com/wollardj/simple-plist/issues/60 ↗
- https://github.com/wollardj/simple-plist/issues/60#issuecomment-1083991840 ↗
- https://github.com/wollardj/simple-plist/commit/670e22fd6e46549a1d32d1065981e0f58eab98d6 ↗
- https://github.com/advisories/GHSA-gff7-g5r8-mg8m ↗