CVE-2020-28278

Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28278

creationtimestamp| type| source ---|---|--- 2022-05-24 17:37:25+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pqwc-3vhw-qcvq...

@averjs/core (>=1.0.22, <=2.0.0-3), @cojecom/vuex-persistedstate (2.5.4) +11 more potentially affected by CVE-2020-28278 via shvl (1.3.1)

shvl NPM version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on shvl and may be impacted: - @averjs/core =1.0.22, =1.1.37, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =1.0.0, =2.3.0, =1.1.1, =5.2.0 Source cves: CVE-2020-28278 Source advisory:...

CVE-2020-28278

Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2020-28278

Summary (CVE-2020-28278) : The npm module shvl (versions 1.0.0–2.0.1) is affected by a prototype-pollution vulnerability. The issue arises in the set() function where unvalidated paths (e.g., proto ) can pollute Object.prototype, enabling Denial of Service and potentially Remote Code Execution. P...