critical9.8
CVE-2023-38894
tree-kit Prototype Pollution vulnerability
Impact
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | tree-kit | < 0.7.5 | 0.7.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tree Kit Project | Tree Kit | through 0.7.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/cronvel/tree-kit
- https://www.code-intelligence.com/blog/treekit-prototype-pollution-cve-2023-38894
- https://github.com/advisories/GHSA-5p42-m6f3-hpmj
- https://nvd.nist.gov/vuln/detail/CVE-2023-38894
- https://github.com/cronvel/tree-kit/commit/61bf10cf0dbddaeea3f198cfe7cb469f360d82bc
- http://tree-kit.com