https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 17:54:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-212849 EUVD-2026-212849 https://cve.radiocsirt.org/vuln/euvd-2026-212849 https://cve.radiocsirt.org/vuln/fkie_cve-2023-30857 <p>@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class&#39; metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class&#39;s metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.</p> <p>@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class&#39; metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class&#39;s metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-30857 https://cve.radiocsirt.org/vuln/ghsa-wwxh-74fx-33c6 <p><strong>Affected:</strong> npm: @aedart/support</p> <p>### Impact</p> <p>Possible prototype pollution for the `MetadataRecord`, when merged with a base class&#39; metadata object, in `meta` decorator from the `@aedart/support` package.</p> <p>The likelihood is questionable, given that a class&#39; metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can become a vulnerability. ### Patches</p> <p>Has been patched in version `0.6.1`.</p> <p><strong>Affected:</strong> npm: @aedart/support</p> <p>### Impact</p> <p>Possible prototype pollution for the `MetadataRecord`, when merged with a base class&#39; metadata object, in `meta` decorator from the `@aedart/support` package.</p> <p>The likelihood is questionable, given that a class&#39; metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can become a vulnerability. ### Patches</p> <p>Has been patched in version `0.6.1`.</p> https://cve.radiocsirt.org/vuln/ghsa-wwxh-74fx-33c6 https://cve.radiocsirt.org/vuln/gsd-2023-30857 gsd-2023-30857 https://cve.radiocsirt.org/vuln/gsd-2023-30857