Description

Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.

Remediation

References

https://hackerone.com/reports/778414

Related Vulnerabilities

CVE-2023-50730 Vulnerability in maven package edu.gemini:gsp-graphql-core_sjs1_3

CVE-2020-14445 Vulnerability in maven package org.wso2.carbon.identity.framework:org.wso2.carbon.policyeditor.ui

CVE-2022-32065 Vulnerability in maven package com.ruoyi:ruoyi

CVE-2022-1245 Vulnerability in maven package org.keycloak:keycloak-services

CVE-2021-33609 Vulnerability in maven package com.vaadin:vaadin-server

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Patch Third Party Advisory CWE-20