high7.5
CVE-2022-25352
The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js.
Impact
The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Libnested Project | Libnested | before 1.5.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/dominictarr/libnested/blob/master/index.js%23L22
- https://github.com/dominictarr/libnested/commit/c1129865d75fbe52b5a4f755ad3110ca5420f2e1
- https://snyk.io/vuln/SNYK-JS-LIBNESTED-2342117
- https://github.com/dominictarr/libnested/blob/master/index.js%23L22
- https://github.com/dominictarr/libnested/commit/c1129865d75fbe52b5a4f755ad3110ca5420f2e1
- https://snyk.io/vuln/SNYK-JS-LIBNESTED-2342117