~ / search / GHSA-6c8f-qphg-qjgp

GHSA-6c8f-qphg-qjgp

Validation Bypass in kind-of

Source: GitHub Advisory Database (reviewed) High CVE-2019-20149

Packages

EcosystemPackageAffectedFixed in
npm kind-of >= 6.0.0, < 6.0.3 6.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `kind-of` 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. ## Recommendation Upgrade to versions 6.0.3 or later.

References

External links from the advisory. They lead to third-party sites.