Prototype Pollution

grunt-karma is vulnerable to prototype pollution. The vulnerability is due to the exports functions in grunt-karma.js where an attacker cam injects properties into the existing JavaScript construct prototype...

PT-2022-24023 · Unknown · Grunt-Karma +1

Name of the Vulnerable Software and Affected Versions: karma-runner grunt-karma version 4.0.1 Description: The issue is related to a prototype pollution vulnerability in the karma-runner grunt-karma. It occurs via the key variable in grunt-karma.js. Recommendations: For version 4.0.1, consider...

Cross-site Scripting (XSS)

karma is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the returnUrl parameter in the complete function of karma.js by navigating to the malicious URLs...