https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T16:28:28.916289+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-212849 EUVD-2026-212849 2026-10-12T16:28:28.919650+00:00 EUVD-2026-212849 https://cve.radiocsirt.org/vuln/fkie_cve-2023-30857 fkie_cve-2023-30857 2026-10-12T16:28:28.919680+00:00

@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.

 https://cve.radiocsirt.org/vuln/ghsa-wwxh-74fx-33c6 GHSA-wwxh-74fx-33c6 — Possible prototype pollution in metadata record, when using meta decorator 2026-10-12T16:28:28.919713+00:00

Affected: npm: @aedart/support

### Impact

Possible prototype pollution for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package.

The likelihood is questionable, given that a class' metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can become a vulnerability. ### Patches

Has been patched in version `0.6.1`.

 https://cve.radiocsirt.org/vuln/gsd-2023-30857 gsd-2023-30857 2026-10-12T16:28:28.919741+00:00 gsd-2023-30857