CVE-2024-36573

2024-06-1700:00:00

mitre

github.com

almela obx

v.0.0.4

prototype pollution

arbitrary code execution

AI Score

7.7

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:almela:obx:*:*:*:*:*:*:*:*"
    ],
    "vendor": "almela",
    "product": "obx",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.0.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]