EUVD-2021-1030

Malware in sbrugna...

Prototype Pollution

Overview simpl-schema before 1.10.2 is vulnerable to prototype pollution. Attacker controlled input into a schema could result in remote code execution within the scope of the surrounding application. Recommendation Upgrade to version 1.10.2 or later References - CVE - GitHub Advisory...

@deskpro/apps-installer (>=0.3.1 <=0.4.5), @deskproapps/deskproapps-sdk-react (>=0.1.3 <=1.0.0-alpha) +19 more potentially affected by CVE-2020-7742 via simpl-schema (>=0.0.1 <=0.5.0)

simpl-schema NPM version =0.0.1, =0.3.1, =0.1.3, =0.0.1, =1.0.11, =0.0.1, =0.7.5, =0.0.1, =0.4.0, =0.1.0, =0.1.0, =1.0.4, =0.1.0, =0.1.0, =0.0.9, =0.0.14 and more Source cves: CVE-2020-7742 Source advisory: OSV:GHSA-9MX2-PRFP-8HQP...

Prototype Pollution in simpl-schema

This affects the package simpl-schema before 1.10.2. Attacker controlled input into a schema could result in remote code execution within the scope of the surrounding application...

GHSA-9MX2-PRFP-8HQP Prototype Pollution in simpl-schema

This affects the package simpl-schema before 1.10.2. Attacker controlled input into a schema could result in remote code execution within the scope of the surrounding application...

Prototype Pollution

simpl-schema is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CVE-2020-7742

This affects the package simpl-schema before 1.10.2...

Code injection

This affects the package simpl-schema before 1.10.2...

CVE-2020-7742 Prototype Pollution

This affects the package simpl-schema before 1.10.2...

CVE-2020-7742

CVE-2020-7742 affects the JavaScript package simpl-schema up to version 1.10.1. The vulnerability is a prototype pollution flaw in the library's merge logic (used for merging inputs into schemas), allowing attacker-controlled input to mutate Object.prototype and potentially lead to remote code ex...

Prototype Pollution

Overview simpl-schema is a schema validation package that supports direct validation of MongoDB update modifier objects. Affected versions of this package are vulnerable to Prototype Pollution. PoC const SimpleSchema = require"simpl-schema".default; let obj = ; console.log"Before : " +...