GHSA-9fp7-4fjm-q3mf

Prototype Pollution in keyget

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23760

Packages

Ecosystem	Package	Affected	Fixed in
npm	keyget	<= 2.4.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-28272](https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048)

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23760 advisory
https://github.com/rumkin/keyget package
https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048 web
https://snyk.io/vuln/SNYK-JS-KEYGET-2342624 web