@dependable/session (0.7.0), angularjs-lively (0.0.1) +18 more potentially affected by CVE-2021-25915 via changeset (>=0.0.5, <=0.2.1)

changeset NPM version =0.0.5, =0.2.0, =1.0.1, =0.0.4, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.1.10, =2.0.0, =1.0.0, =1.0.3 - observable-delta-stream 0.1.0 and more Source cves: CVE-2021-25915 Source advisory: OSV:GHSA-2GQW-Q9R9-7F79...

CVE-2021-25915

Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25915

CVE-2021-25915 affects the npm package changeset (versions 0.0.1–0.2.5). The root cause is a prototype-pollution flaw in the apply() function that allows unvalidated changes to pollute Object prototypes, enabling Denial of Service and potentially Remote Code Execution. Public advisories (GitHub G...