@cdr0/active-development (=1.0.0), @cdr0/config (>=1.0.1 <=1.0.2) +6 more potentially affected by CVE-2024-36580 via @cdr0/sg (=1.0.10)

@cdr0/sg NPM version =1.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on @cdr0/sg and may be impacted: - @cdr0/active-development =1.0.0 - @cdr0/config =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.1 Source cves: CVE-2024-36580 Source advisory:...

CVE-2024-36580

A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code...

CVE-2024-36580

CVE-2024-36580 affects cdr0 sg 1.0.10 with a Prototype Pollution vulnerability due to improper handling of user-supplied inputs in ref.js, allowing modification of proto and constructor.prototype. The Veracode entry notes potential remote code execution or denial of service as outcomes for affect...