@cdr0/active-development (1.0.0), @cdr0/config (>=1.0.1, <=1.0.2) +6 more potentially affected by CVE-2024-36580 via @cdr0/sg (1.0.10)

@cdr0/sg NPM version 1.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on @cdr0/sg and may be impacted: - @cdr0/active-development 1.0.0 - @cdr0/config =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.1 Source cves: CVE-2024-36580 Source advisory:...

CVE-2024-36580

A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code...

CVE-2024-36580

The @cdr0/sg package (version 1.0.10 ) is vulnerable to a Prototype Pollution issue. The root cause stems from improper handling of user-supplied inputs within ref.js , specifically allowing the manipulation of __proto__ and constructor.prototype properties. This flaw enables an attacker to alt...