Prototype Pollution in js-data · CVE-2020-28442 · GitHub Advisory Database · GitHub

Prototype Pollution in js-data

Critical severity GitHub Reviewed Published Feb 9, 2022 to the GitHub Advisory Database • Updated Sep 5, 2023

Package

js-data (npm)

Affected versions

< 3.0.10

Patched versions

3.0.10

Description

All versions of package js-data prior to 3.0.10 are vulnerable to Prototype Pollution via the deepFillIn function.

References

Published by the National Vulnerability Database

Dec 15, 2020

Reviewed Apr 8, 2021

Published to the GitHub Advisory Database Feb 9, 2022

Last updated Sep 5, 2023

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H