@anandsuresh/smart-stream (>=1.0.1, <=1.1.0), @anandsuresh/smart_stream (1.0.0) +10 more potentially affected by CVE-2021-21368 via msgpack5 (>=4.0.2, <=4.4.0)

msgpack5 NPM version =4.0.2, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.2, =1.2.9, =2.0.0-rc1, =0.5.6, =0.1.0, =0.1.3 Source cves: CVE-2021-21368 Source advisory: OSV:GHSA-GMJW-49P4-PCFM...

imapapi (>=1.4.6, <=1.4.9) potentially affected by CVE-2021-21368 via msgpack5 (>=5.0.0, <=5.2.0)

msgpack5 NPM version =5.0.0, =1.4.6, =1.4.9 Source cves: CVE-2021-21368 Source advisory: OSV:GHSA-GMJW-49P4-PCFM...

Prototype poisoning

Impact The issue is as follows: when msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. As you are no doubt aware, Object.prototype.proto is an accessor property for the receiver's prototype. If the value corresponding to the key proto decodes to an object or...

hemera-msgpack (>=1.0.1, <=1.0.9), hexadb (>=0.8.0, <=0.8.2) +9 more potentially affected by CVE-2021-21368 via msgpack5 (>=3.1.0, <=3.5.1)

msgpack5 NPM version =3.1.0, =1.0.1, =0.8.0, =0.0.3, =0.6.2, =0.1.0, =0.1.0, =1.0.0, =0.2.0, =1.0.0, =1.2.0 Source cves: CVE-2021-21368 Source advisory: GHSA-GMJW-49P4-PCFM...

@anandsuresh/smart-stream (>=1.0.1, <=1.1.0), @anandsuresh/smart_stream (1.0.0) +10 more potentially affected by CVE-2021-21368 via msgpack5 (>=4.0.2, <=4.4.0)

msgpack5 NPM version =4.0.2, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.2, =1.2.9, =2.0.0-rc1, =0.5.6, =0.1.0, =0.1.3 Source cves: CVE-2021-21368 Source advisory: GHSA-GMJW-49P4-PCFM...

imapapi (>=1.4.6, <=1.4.9) potentially affected by CVE-2021-21368 via msgpack5 (>=5.0.0, <=5.2.0)

msgpack5 NPM version =5.0.0, =1.4.6, =1.4.9 Source cves: CVE-2021-21368 Source advisory: GHSA-GMJW-49P4-PCFM...

CVE-2021-21368

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. Object.prototype.proto is an access...

CVE-2021-21368

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. Object.prototype.proto is an access...

Code injection

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. Object.prototype.proto is an access...

CVE-2021-21368 Prototype poisoning

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. Object.prototype.proto is an access...

CVE-2021-21368

CVE-2021-21368 (msgpack5) affects msgpack5 up to versions 3.6.1, 4.5.1, and 5.2.1. Decoding a map with the key "proto " can set the decoded object’s prototype to a value, potentially causing values to resemble other types or trigger unexpected behavior. The issue does not alter the global Object....

CVE-2021-21368

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. Object.prototype.proto is an access...

bigio (>=0.1.3, <=0.1.13), deadpool (0.0.1) +45 more potentially affected by CVE-2021-21368 via msgpack5 (>=1.3.5, <=3.5.1)

msgpack5 NPM version =1.3.5, =0.1.3, =0.3.0, =1.0.1, =0.2.0, =0.1.6, =0.1.0, =0.0.3, =0.0.3, =0.0.3, =0.6.2, =0.7.6 and more Source cves: CVE-2021-21368 Source advisory: MEND:CVE-2021-21368...

@anandsuresh/smart-stream (>=1.0.1, <=1.1.0), @anandsuresh/smart_stream (1.0.0) +10 more potentially affected by CVE-2021-21368 via msgpack5 (>=4.0.2, <=4.4.0)

msgpack5 NPM version =4.0.2, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.2, =1.2.9, =2.0.0-rc1, =0.5.6, =0.1.0, =0.1.3 Source cves: CVE-2021-21368 Source advisory: MEND:CVE-2021-21368...

imapapi (>=1.4.6, <=1.4.9) potentially affected by CVE-2021-21368 via msgpack5 (>=5.0.0, <=5.2.0)

msgpack5 NPM version =5.0.0, =1.4.6, =1.4.9 Source cves: CVE-2021-21368 Source advisory: MEND:CVE-2021-21368...

Matteo Collina msgpack5 security vulnerability

Matteo Collina msgpack5 is a Matteo Collina open source application . Provides a msgpack v5 implementation for node.js and browsers with extension point support. A security vulnerability exists in Matteo Collina msgpack5 that stems from the fact that an attacker who submits carefully crafted...

CVE-2021-21368: Improperly Controlled Modification of Dynamically-Determined Object Attributes

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. Object.prototype.proto is an access...