class-transformer input validation error vulnerability

class-transformer is a package that can transform/serialize/deserialize JavaScript objects to class constructors. An input validation error vulnerability exists in class-transformer. The vulnerability stems from a networked system or product that does not properly validate input data. No details ...

CVE-2020-7637

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2020-7637

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

Design/Logic Flaw

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2020-7637

CVE-2020-7637 affects class-transformer versions prior to 0.3.1. The vulnerability stems from classToPlainFromExist allowing a proto payload to pollute Object.prototype, enabling attacker-controlled modification of object properties. Impact is described as prototype pollution; upstream fixes requ...

CVE-2020-7637

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

PT-2020-19673 · None · Class-Transformer

Name of the Vulnerable Software and Affected Versions: class-transformer versions prior to 0.3.1 Description: The issue allows attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payloa...

@3volutions/welle7.lib (=1.0.1), @acathur/koa-decorator-ts (>=2.7.0 <=2.7.4) +1163 more potentially affected by CVE-2020-7637 via class-transformer (>=0.1.10 <=0.2.3)

class-transformer NPM version =0.1.10, =2.7.0, =1.0.0, =0.1.0, =0.0.4, =0.0.1, =1.0.1, =0.0.1, =1.3.0-next.2, =1.2.0, =1.0.1, =0.0.1, =0.0.1, =0.0.9, =0.0.18 and more Source cves: CVE-2020-7637 Source advisory: SNYK:JS-CLASSTRANSFORMER-564431...

Prototype Pollution

Overview class-transformer is a Proper decorator-based transformation / serialization / deserialization of plain javascript objects to class constructors. Affected versions of this package are vulnerable to Prototype Pollution the classToPlainFromExist function could be tricked into adding or...