https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 14:42:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-47014 EUVD-2026-47014 https://cve.radiocsirt.org/vuln/euvd-2026-47014 https://cve.radiocsirt.org/vuln/fkie_cve-2020-28278 <p>Prototype pollution vulnerability in &#39;shvl&#39; versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.</p> <p>Prototype pollution vulnerability in &#39;shvl&#39; versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-28278 https://cve.radiocsirt.org/vuln/ghsa-pqwc-3vhw-qcvq <p><strong>Affected:</strong> npm: shvl</p> <p>### Overview Prototype pollution vulnerability in &#39;shvl&#39; versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.</p> <p>### Details The NPM module &#39;shvl&#39; can be abused by Prototype Pollution vulnerability since the function &#39;set()&#39; did not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.</p> <p>### PoC Details The &#39;set()&#39; function accepts four arguments `object, path, val, obj`. Due to the absence of validation, at values passed into `path, val` arguments, an attacker can supply a malicious value by adjusting the `path` value to include the `__proto__` property. Since there is no validation before assigning property to check whether the assigned `path` is the Object&#39;s own property or not, the property `isAdmin` will be directly be assigned to the empty obj({}) thereby polluting the Object prototype. Later in the code, if there is a check to validate `isAdmin` the valued would be substituted as &#34;true&#34; as it had been polluted.</p> <p>```js const shvl = require(&#39;shvl&#39;); var obj = {} console.log(&#34;Before : &#34; + obj.isAdmin); shvl.set(obj, &#39;__proto__.isAdmin&#39;, true); console.log(&#34;After : &#34; + obj.isAdmin); ```</p> <p>### Affected Environments 1.0.0-2.0.1</p> <p>### Remediation There are a couple of ways to mitigate prototype pollution vulnerabilities, for example:…</p> <p><strong>Affected:</strong> npm: shvl</p> <p>### Overview Prototype pollution vulnerability in &#39;shvl&#39; versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.</p> <p>### Details The NPM module &#39;shvl&#39; can be abused by Prototype Pollution vulnerability since the function &#39;set()&#39; did not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.</p> <p>### PoC Details The &#39;set()&#39; function accepts four arguments `object, path, val, obj`. Due to the absence of validation, at values passed into `path, val` arguments, an attacker can supply a malicious value by adjusting the `path` value to include the `__proto__` property. Since there is no validation before assigning property to check whether the assigned `path` is the Object&#39;s own property or not, the property `isAdmin` will be directly be assigned to the empty obj({}) thereby polluting the Object prototype. Later in the code, if there is a check to validate `isAdmin` the valued would be substituted as &#34;true&#34; as it had been polluted.</p> <p>```js const shvl = require(&#39;shvl&#39;); var obj = {} console.log(&#34;Before : &#34; + obj.isAdmin); shvl.set(obj, &#39;__proto__.isAdmin&#39;, true); console.log(&#34;After : &#34; + obj.isAdmin); ```</p> <p>### Affected Environments 1.0.0-2.0.1</p> <p>### Remediation There are a couple of ways to mitigate prototype pollution vulnerabilities, for example:…</p> https://cve.radiocsirt.org/vuln/ghsa-pqwc-3vhw-qcvq https://cve.radiocsirt.org/vuln/gsd-2020-28278 gsd-2020-28278 https://cve.radiocsirt.org/vuln/gsd-2020-28278