CVE-2022-37264

Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js...

Code injection

Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js...

Denial of service

A Regular Expression Denial of Service ReDoS flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js...

CVE-2022-37264

CVE-2022-37264 affects stealjs/steal 2.2.4. The root cause is prototype pollution caused by unvalidated optionName handling in main.js, enabling an attacker to modify objects via the proto property. Documents identify this as a prototype pollution vulnerability with high impact; the CVSS base sco...

CVE-2022-37264

Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js...

CVE-2022-37262

CVE-2022-37262 is a ReDoS flaw affecting stealjs (StealJS) 2.2.4, reported via the source and sourceWithComments variables in main.js. Connected sources (Red Hat, Veracode, GHSA, OSV, CVE listings) consistently describe a Regular Expression Denial of Service vulnerability exploitable through craf...

CVE-2022-37266

Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js...

CVE-2022-37266

Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js...

CVE-2022-37257

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js...

Code injection

Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js...

CVE-2022-37257

CVE-2022-37257 affects stealjs Steal 2.2.4 (prototype pollution) in the convertLater function via the requestedVersion variable in npm-convert.js. Root cause: prototype contamination allowing injection into proto , constructor, and prototype chains. Impact per sources: high confidentiality, integ...

CVE-2022-37257

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js...

CVE-2022-37266

Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js...

CVE-2022-37266

Summary: CVE-2022-37266 is a prototype pollution vulnerability in StealJS (steal) 2.2.4, affecting the babel.js extension where the attack occurs via the key variable in babel.js. The issue is rooted in the function extend and allows modification of object prototypes (e.g., proto , constructor, p...

CVE-2022-37266

Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js...

steal 安全漏洞

steal is StealJS open source an extensible general-purpose module loader . It can load JavaScript modules defined in ES6, AMD and CommonJS formats. A security vulnerability exists in steal 2.2.4, which originates from a StealJS Regular Expression Denial of Service ReDoS via the optionName variabl...

PT-2022-23906 · Stealjs · Stealjs

Name of the Vulnerable Software and Affected Versions: stealjs steal version 2.2.4 Description: The issue is related to a prototype pollution vulnerability in the extend function in babel.js within stealjs steal. This vulnerability is exploited via the key variable in babel.js. Recommendations: F...

PT-2022-23902 · Stealjs · Stealjs

Name of the Vulnerable Software and Affected Versions: stealjs steal version 2.2.4 Description: A Regular Expression Denial of Service ReDoS flaw was found in the input variable in main.js. This issue can cause a denial of service. Recommendations: For version 2.2.4, consider restricting the inpu...

steal 安全漏洞

steal is StealJS open source an extensible general-purpose module loader . It can load JavaScript modules defined in ES6, AMD and CommonJS formats. A security vulnerability exists in steal 2.2.4, which results in a steal Regular Expression Denial of Service ReDoS via input variables in main.js...

PT-2022-23898 · Stealjs · Stealjs

Name of the Vulnerable Software and Affected Versions: stealjs steal version 2.2.4 Description: The issue is related to a prototype pollution vulnerability in the convertLater function in npm-convert.js. This vulnerability is exploited via the requestedVersion variable in npm-convert.js...