CVE-2022-26260

Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse...

@cerebroapp/cerebro-shell (>=1.0.0-alpha.1, <=1.0.0), @cerebroapp/cerebro-ui (>=2.0.0-alpha.3, <=2.0.0-alpha.4) +4 more potentially affected by CVE-2022-26260 via simple-plist (>=1.1.0, <=1.1.1)

simple-plist NPM version =1.1.0, =1.0.0-alpha.1, =2.0.0-alpha.3, =0.1.0, =1.0.143, =1.0.46, =4.0.2-beta.0 Source cves: CVE-2022-26260 Source advisory: OSV:GHSA-GFF7-G5R8-MG8M...

CVE-2022-26260

CVE-2022-26260 affects Simple-Plist v1.3.0. The Red Hat, Veracode, and OSV entries, plus CVE records, confirm a prototype-pollution vulnerability in the library exposed via the .parse() function. Root cause: improper handling during parsing that allows injection of properties into construct proto...