GHSA-92xj-mqp7-vmcj

Prototype Pollution in node-forge

Source: GitHub Advisory Database (reviewed) High CVE-2020-7720

Packages

Ecosystem	Package	Affected	Fixed in
npm	node-forge	< 0.10.0	0.10.0

Details

As written in the advisory (Markdown source, shown as plain text).

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing the vulnerable functions.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7720 advisory
https://github.com/digitalbazaar/forge/commit/6a1e3ef74f6eb345bcff1b82184201d1e28b6756 web
https://github.com/digitalbazaar/forge package
https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md web
https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md#removed web
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293 web
https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677 web