Open-source package vulnerability · npm
CVE-2024-36573: obx Prototype Pollution
criticalCVSS 4.0 9.3 · 3.1 9.8GHSA-jj58-488v-4rgf
almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.
Published Jun 17, 2024 · Updated Aug 2, 2024
Affected packages
@almela/obx
- Ecosystem
- npm
- Affected
- < 0.0.4
- Fixed in
- 0.0.4
- Check
npm ls @almela/obx
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology