high7.5
CVE-2024-57082
@rpldy/uploader prototype pollution
Impact
A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @rpldy/uploader | < 1.9.1 | 1.9.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/tariqhawis/708e518de0c3b5af7430ec774f68f315
- https://github.com/advisories/GHSA-pc47-g7gv-4gpw
- https://nvd.nist.gov/vuln/detail/CVE-2024-57082
- https://github.com/rpldy/react-uploady/commit/386e0a80c428eb988e89fd2acf9bb0b786ac8028
- https://github.com/rpldy/react-uploady/releases/tag/v1.9.1