Prototype Pollution

2020-04-0706:14:14

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

39.0%

JSON

class-transformer is vulnerable to prototype pollution. The vulnerability exists as __proto__ payload could be introduced into the classToPlainFromExist function.

CPENameOperatorVersion
class-transformereq0.1.2
class-transformerle0.2.3
class-transformereq0.1.2
class-transformerle0.2.3

Name	Operator	Version
class-transformer	eq	0.1.2
class-transformer	le	0.2.3
class-transformer	eq	0.1.2
class-transformer	le	0.2.3

References

github.com/advisories/GHSA-6gp3-h3jj-prx4

github.com/typestack/class-transformer/blob/a650d9f490573443f62508bc063b857bcd5e2525/src/ClassTransformer.ts#L29-L31

github.com/typestack/class-transformer/commit/8f04eb9db02de708f1a20f6f2d2bb309b2fed01e

0.001 Low

EPSS

Percentile

39.0%

JSON

Related for VERACODE:22953