Description
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | datatables.net | < unspecified | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.2.5-1.el8ev | RHSA-2021:1186 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.6.7-1.el8ev | RHSA-2021:1169 |
| Red Hat Rhev Manager 4 | rhvm +19 | 4.4.5.9-0.1.el8ev | RHSA-2021:1169 |
| Red Hat Rhev Hypervisor 4 | cockpit-ovirt +1 | 0.14.20-1.el8ev | RHSA-2021:1184 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | reaper | 3.1.1-15 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
fazilbaig1/CVE-2020-28458 ★ 6 · Oct 19, 2024
Affected versions of this package are vulnerable to Prototype Pollution.
-
Raka200juta/28458 ★ 1 · Dec 4, 2025
cve-2020-28458
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | datatables.net | < 1.10.22 | 1.10.22 | GHSA-m7j4-fhg6-xf5v |
Advisories 4
- RHSA-2021:1184 Red Hat Security Advisory: RHV RHEL Host (ovirt-host) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2021:1169 Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement Red Hat Security Advisories (RHSA) · Feb 24, 2026
- RHSA-2021:1186 Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] 0-day security, bug fix, enhance Red Hat Security Advisories (RHSA) · Jan 14, 2026
- WID-SEC-2022-0808 Red Hat Virtualization Engine: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2025
References
- https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1051961
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1051962
- https://github.com/DataTables/Dist-DataTables/blob/master/js/jquery.dataTables.js%23L2766
- https://github.com/DataTables/DataTablesSrc/commit/a51cbe99fd3d02aa5582f97d4af1615d11a1ea03
- https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806
- https://security.netapp.com/advisory/ntap-20240621-0006/