EUVD-2024-2781

Malicious code in bioql PyPI...

Prototype Pollution

dset is vulnerable to Prototype Pollution. The vulnerability is due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program...

0xsodium (>=0.2.0 <=0.14.0), @0xsodium/graphquery (>=0.2.0 <=0.14.0) +469 more potentially affected by CVE-2024-21529 via dset (>=1.0.1 <=3.1.3)

dset NPM version =1.0.1, =0.2.0, =0.2.0, =0.2.0, =1.7.3, =0.2.0, =0.0.4, =0.0.4, =0.6.0, =0.2.0, =0.2.0, =0.0.0, =1.4.0-beta.2, =0.1.0, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2024-21529 Source advisory: OSV:GHSA-F6V4-CF5J-VF3W...

0xsodium (>=0.2.0 <=0.14.0), @0xsodium/graphquery (>=0.2.0 <=0.14.0) +176 more potentially affected by CVE-2024-21529 via dset (>=3.1.0 <=3.1.3)

dset NPM version =3.1.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.0.4, =0.0.4, =0.6.0, =0.2.0, =0.2.0, =0.0.0, =1.4.0-beta.2, =0.1.0, =0.1.10, =0.1.11 - @didomi/react =1.8.3 and more Source cves: CVE-2024-21529 Source advisory: SNYK:JS-DSET-7116691...

@trovo/components (>=5.0.2 <=5.3.0), @trovo/motion (>=5.0.2 <=6.0.0) +9 more potentially affected by CVE-2020-28277 via dset (=1.0.1)

dset NPM version =1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on dset and may be impacted: - @trovo/components =5.0.2, =5.0.2, =5.0.0, =1.0.15, =1.1.4, =1.0.0, =2.2.0, =1.0.0, =0.0.1, =0.0.2, =0.0.11 Source cves: CVE-2020-28277 Source advisory:...

@3-shake/3design-ui (>=1.7.3 <=2.1.7), @aider/ui (>=0.0.1 <=0.9.0) +302 more potentially affected by CVE-2022-25645 via dset (>=1.0.1 <=3.1.1)

dset NPM version =1.0.1, =1.7.3, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =0.14.1, =2.8.2, =2.4.0, =2.4.0, =3.0.0, =1.0.0, =3.1.0 and more Source cves: CVE-2022-25645 Source advisory: OSV:GHSA-23WX-CGXQ-VPWX...

@danitt/analytics-next (=1.33.4), @danitt/tsub (>=0.1.10 <=0.1.11) +4 more potentially affected by CVE-2022-25645 via dset (>=3.1.0 <=3.1.1)

dset NPM version =3.1.0, =0.1.10, =0.1.10, =0.8.0, =1.0.0, =1.3.0, =1.3.3 Source cves: CVE-2022-25645 Source advisory: SNYK:JS-DSET-2330881...