Open-source package vulnerability · npm
CVE-2024-24294: Blackprint @blackprint/engine Prototype Pollution issue
criticalCVSS 3.1 9.8GHSA-g3q2-vcjq-rgrc
A Prototype Pollution issue in Blackprint @blackprint/engine 0.8.12 through 0.9.1 allows an attacker to execute arbitrary code via the utils.setDeepProperty function of engine.min.js.
Published May 20, 2024 · Updated Jul 5, 2024
Affected packages
@blackprint/engine
- Ecosystem
- npm
- Affected
- >= 0.8.12, < 0.9.2
- Fixed in
- 0.9.2
- Check
npm ls @blackprint/engine
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A Prototype Pollution issue in Blackprint @blackprint/engine 0.8.12 through 0.9.1 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology