MAL-2025-27142 Malicious code in nconf-galaxy-repository-cosmos (npm)

The package nconf-galaxy-repository-cosmos was found to contain malicious code...

CVE-2021-25946

Prototype pollution vulnerability in nconf-toml versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution...

Security Bulletin: A security vulnerability in Node.js nconf affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js nconf affects IBM Cloud Automation Manager Vulnerability Details CVEID:CVE-2022-21803 DESCRIPTION: Node.js nconf module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw when using the memory...

Security Bulletin: A security vulnerability in Node.js nconf affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Node.js nconf affects IBM Cloud Pak for Multicloud Management Managed Services. Vulnerability Details CVEID:CVE-2022-21803 DESCRIPTION: Node.js nconf module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution...

Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution due to async ( CVE-2021-43138) and nconf (CVE-2022-21803)

Summary IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution, due to the async CVE-2021-43138 and nconf CVE-2022-21803 modules for Node.js. A mitigation has been provided for IBM Integration Bus. The latest fix packs for IBM App Connect Enterprise includes...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.5.0 is now generally available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.4.4 General Availability release images. This update provides security fixes, bug fixes, and updates container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System...

nconf has unspecified vulnerabilities

nconf is a TOML-formatted plugin. nconf versions prior to 0.11.4 have a security vulnerability that stems from the .set function, which is responsible for setting configuration properties, being vulnerable to prototype contamination, which can be exploited by attackers to override JavaScript...

Prototype Pollution

nconf is vulnerable to prototype pollution. The function prototype.set allows an attacker to get control of value of “path” and modify attributes such as proto, constructor and prototype...

4pm-cli (>=0.0.1, <=0.0.5), 7ghost (>=4.11.0, <=4.11.46) +2954 more potentially affected by CVE-2022-21803 via nconf (>=0.1.14, <=0.11.3)

nconf NPM version =0.1.14, =0.0.1, =4.11.0, =0.0.1, =0.8.7, =3.6.0-beta.3, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =3.0.0, =1.1.0, =2.0.4, =1.0.0, =1.2.10 - @algtools/leetcode-cli 1.0.0 and more Source cves: CVE-2022-21803 Source advisory: OSV:GHSA-6XWR-Q98W-RVG7...

Prototype Pollution in nconf

nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to...

GHSA-6XWR-Q98W-RVG7 Prototype Pollution in nconf

nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to...

CVE-2022-21803

A flaw was found in the nconf library when setting the configuration properties. This flaw allows an attacker to provide a crafted property, leading to prototype object pollution...

CVE-2022-21803

CVE-2022-21803 affects Node.js nconf prior to 0.11.4. When using the memory engine, a crafted property can trigger prototype pollution by modifying Object.prototype via proto or constructor payloads, potentially enabling arbitrary code execution or a denial of service. A fix is available in nconf...

CVE-2022-21803 Prototype Pollution

This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted...

CVE-2022-21803 Prototype Pollution

This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted...

CVE-2022-21803

This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted...

nconf 安全漏洞

nconf is a TOML-formatted plugin. nconf versions prior to 0.11.4 have a security vulnerability that stems from the .set function, which is responsible for setting configuration properties, being vulnerable to prototype contamination, which can be exploited by attackers to override JavaScript...

Prototype Pollution

Overview nconf is a Hierarchical node.js configuration with files, environment variables, command-line arguments, and atomic object merging. Affected versions of this package are vulnerable to Prototype Pollution. When using the memory engine, it is possible to store a nested JSON representation ...

4pm-cli (>=0.0.1, <=0.0.5), 7ghost (>=4.11.0, <=4.11.46) +2954 more potentially affected by CVE-2022-21803 via nconf (>=0.1.14, <=0.11.3)

nconf NPM version =0.1.14, =0.0.1, =4.11.0, =0.0.1, =0.8.7, =3.6.0-beta.3, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =3.0.0, =1.1.0, =2.0.4, =1.0.0, =1.2.10 - @algtools/leetcode-cli 1.0.0 and more Source cves: CVE-2022-21803 Source advisory: SNYK:JS-NCONF-2395478...