CVE-2021-4278

The CVE-2021-4278 entry concerns cronvel tree-kit versions up to 0.6.x and describes a prototype pollution issue resulting from improper checks that allow manipulation of object prototype attributes. The root cause is an undefined part of the codebase, with the recommended remediation being an up...

CVE-2023-38894

The CVE-2023-38894 entry concerns a Prototype Pollution vulnerability in Cronvel Tree-kit v0.7.4 and earlier. Affected component: the extend function used on nested objects. Root cause: prototype contamination allows an attacker to manipulate object prototypes, enabling remote arbitrary code exec...