GHSA-p734-xg27-8cfq

Prototype pollution in izatop bunt

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-38989

Packages

Ecosystem	Package	Affected	Fixed in
npm	@bunt/app	< 0.29.26	0.29.26

Details

As written in the advisory (Markdown source, shown as plain text).

izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to execute arbitrary code via injecting arbitrary properties.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-38989 advisory
https://github.com/izatop/bunt/issues/27 web
https://github.com/izatop/bunt/commit/c55201a8cee03e5282f99874dead988c80d31db7 web
https://gist.github.com/mestrtee/5e9830fb180a34d65f04fafb52d2b94b web
https://github.com/izatop/bunt package