CVE-2022-22143 Prototype Pollution

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. Note: This vulnerability derives from an incomplete fix of another vulnerability...

CVE-2022-22143

CVE-2022-22143 is a Prototype Pollution flaw in the convict package before 6.2.3. The fix for a related issue was incomplete, enabling pollution through convict’s path handling (parentKey) and bypasses that rely on startsWith; attackers can inject or override attributes, potentially causing crash...

CVE-2022-22143

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. Note: This vulnerability derives from an incomplete fix of another vulnerability...

CVE-2022-22143

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. Note: This vulnerability derives from an incomplete fix of another vulnerability...

CVE-2022-22143: Improperly Controlled Modification of Object Prototype Attributes

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. Note: This vulnerability derives from an incomplete fix of another vulnerability...

convict security vulnerability

convict is a featured configuration management library for Node.js. A security vulnerability exists in versions prior to convict 6.2.2, which stems from the lack of parentKey validation and is susceptible to prototype contamination of the convict function...

PT-2022-15271

Name of the Vulnerable Software and Affected Versions convict versions prior to 6.2.2 Description The issue allows for Prototype Pollution via the convict function due to missing validation of parentKey. This could enable an attacker to inject attributes used in other components or override...