grunt-kevoree (>=0.3.0, <=6.0.0-alpha.1), grunt-kevoree-registry (>=3.0.0, <=4.0.0) +9 more potentially affected by CVE-2020-7724 via tiny-conf (1.1.0)

tiny-conf NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tiny-conf and may be impacted: - grunt-kevoree =0.3.0, =3.0.0, =5.7.0-beta.1, =4.0.0-alpha, =5.5.0-alpha, =0.3.0, =1.6.0, =1.0.0-alpha, =1.0.1, =1.0.0, =1.0.2 Source cves:...

CVE-2020-7724

All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function...

CVE-2020-7724

CVE-2020-7724 affects the tiny-conf package: prototype pollution via the set function. Affected versions are all up to and including 1.1.0; no fixed version is available. Documents describe the vulnerability as enabling property pollution on Object.prototype, with potential DoS or broader impact,...