EUVD-2021-1150

Malware in sbrugna...

@aikosia/automaton (>=0.6.0 <=0.8.1), @aikosia/automaton-cli (>=0.2.1 <=0.3.5) +27 more potentially affected by CVE-2020-7718 via gammautils (>=0.0.2 <=0.0.81)

gammautils NPM version =0.0.2, =0.6.0, =0.2.1, =0.9.0, =0.1.5, =1.0.49, =9.0.0, =0.1.44, =0.1.22, =0.1.20, =1.0.1, =0.0.9, =0.0.7, =0.0.8 and more Source cves: CVE-2020-7718 Source advisory: OSV:GHSA-PGMG-GF5P-54J8...

Prototype Pollution in gammautils

All versions of package gammautils up to and including version 0.0.81 are vulnerable to Prototype Pollution via the deepSet and deepMerge functions...

GHSA-PGMG-GF5P-54J8 Prototype Pollution in gammautils

All versions of package gammautils up to and including version 0.0.81 are vulnerable to Prototype Pollution via the deepSet and deepMerge functions...

Prototype Pollution

gammautils is vulnerable to prototype pollution. The vulnerability exists as it does not restrict the proto header to be set through the deepSet and deepMerge functions...

CVE-2020-7718 Prototype Pollution

All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions...

CVE-2020-7718

CVE-2020-7718 affects the gammautils package. The connected sources confirm a Prototype Pollution vulnerability in gammautils through deepSet and deepMerge, impacting versions prior to 0.0.82 (listed as vulnerable up to 0.0.81 in GHSA/OSV/Veracode entries and PT-2020-19740). The vulnerability can...

PT-2020-19740 · Unknown · Gammautils

Name of the Vulnerable Software and Affected Versions: gammautils versions prior to 0.0.82 Description: The issue concerns Prototype Pollution via the deepSet and deepMerge functions. Recommendations: For versions prior to 0.0.82, update to version 0.0.82 or later to resolve the issue...

@aikosia/automaton (>=0.6.0 <=0.8.1), @aikosia/automaton-cli (>=0.2.1 <=0.3.5) +27 more potentially affected by CVE-2020-7718 via gammautils (>=0.0.2 <=0.0.81)

gammautils NPM version =0.0.2, =0.6.0, =0.2.1, =0.9.0, =0.1.5, =1.0.49, =9.0.0, =0.1.44, =0.1.22, =0.1.20, =1.0.1, =0.0.9, =0.0.7, =0.0.8 and more Source cves: CVE-2020-7718 Source advisory: SNYK:JS-GAMMAUTILS-598670...

Prototype Pollution

Overview gammautils is a Lots of utilities for Node.js Affected versions of this package are vulnerable to Prototype Pollution via the deepSet and deepMerge functions. POC: const gammautils = require'gammautils'; var payload = JSON.parse'""proto"":""polluted"":true'; gammautils.object.deepSet,...