Skip to content
OpenAdvisories
Critical · 9.8 CVE-2022-37258 EUVD-2022-6831GHSA-gvjw-8mmr-8f6g

steal vulnerable to Prototype Pollution

Published Sep 16, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Description

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.

Affected packages

EcosystemPackageAffectedFixedRecord
npm steal <= 2.3.0 — GHSA-gvjw-8mmr-8f6g

References