Fix CVE–2020–28499 #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

debricked wants to merge 1 commit into debricked-fix-bulk_fix-2115f2278938e169 from debricked-fix-CVE_2020_28499-6b2ee68895e30af4

debricked bot commented Oct 6, 2022

CVE–2020–28499

Vulnerable dependency: merge (npm) 1.2.1

Vulnerability details

Description

GitHub

Prototype Pollution in merge

All versions of package merge <2.1.1 are vulnerable to Prototype Pollution via _recursiveMerge .

NVD

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

CVSS details -

9.8

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    CVE-2020-28499 | merge Package Prototype _recursiveMerge code injection (SNYK-JS-MERGE-1042987)
    NVD - CVE-2020-28499
    Prototype Pollution in merge · CVE-2020-28499 · GitHub Advisory Database · GitHub
    CONFIRM
    fix: prototype pollution · yeikos/js.merge@7b0ddc2 · GitHub
    js.merge/index.ts at 56ca75b2dd0f2820f1e08a49f62f04bbfb8c5f8f · yeikos/js.merge · GitHub

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE


          Fix CVE–2020–28499

d296559

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet