All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.
References
Link | Resource |
---|---|
https://security.snyk.io/vuln/SNYK-JS-IANWALTERMERGE-1311022 | Exploit Third Party Advisory |
Configurations
History
01 Aug 2022, 17:50
Type | Values Removed | Values Added |
---|---|---|
References | (CONFIRM) https://security.snyk.io/vuln/SNYK-JS-IANWALTERMERGE-1311022 - Exploit, Third Party Advisory | |
First Time |
Merge Project merge
Merge Project |
|
CWE | CWE-1321 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
CPE | cpe:2.3:a:merge_project:merge:*:*:*:*:*:node.js:*:* |
25 Jul 2022, 15:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-07-25 14:15
Updated : 2023-12-10 14:35
NVD link : CVE-2021-23397
Mitre link : CVE-2021-23397
CVE.ORG link : CVE-2021-23397
JSON object : View
Products Affected
merge_project
- merge
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')