https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 04:09:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-46982 EUVD-2026-46982 https://cve.radiocsirt.org/vuln/euvd-2026-46982 https://cve.radiocsirt.org/vuln/fkie_cve-2020-28272 <p>Prototype pollution vulnerability in &#39;keyget&#39; versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.</p> <p>Prototype pollution vulnerability in &#39;keyget&#39; versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-28272 https://cve.radiocsirt.org/vuln/ghsa-8mp8-28xh-r486 <p><strong>Affected:</strong> npm: keyget</p> <p>### Overview Prototype pollution vulnerability in &#39;keyget&#39; versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.</p> <p>### Details The npm module &#39;keyget&#39; can be abused by Prototype Pollution vulnerability since the function &#39;setByPath()&#39; did not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.</p> <p>### PoC Details The `setByPath()` function accepts three arguments `target, path, value`. Due to the absence of validation, at values passed into `path, value` an attacker can supply a malicious value by adjusting the `path` value to include the `__proto__` property. Since there is no validation before assigning property to check whether the assigned `path` is the Object&#39;s own property or not, the property `polluted` will be directly be assigned to the empty obj({}) thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the value would be substituted as &#34;true&#34; as it had been polluted.</p> <p>### PoC Code ```js var keyget = require(&#34;keyget&#34;) keyget.set({}, &#39;__proto__.polluted&#39;, &#39;true&#39;); console.log(polluted); ```</p> <p><strong>Affected:</strong> npm: keyget</p> <p>### Overview Prototype pollution vulnerability in &#39;keyget&#39; versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.</p> <p>### Details The npm module &#39;keyget&#39; can be abused by Prototype Pollution vulnerability since the function &#39;setByPath()&#39; did not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.</p> <p>### PoC Details The `setByPath()` function accepts three arguments `target, path, value`. Due to the absence of validation, at values passed into `path, value` an attacker can supply a malicious value by adjusting the `path` value to include the `__proto__` property. Since there is no validation before assigning property to check whether the assigned `path` is the Object&#39;s own property or not, the property `polluted` will be directly be assigned to the empty obj({}) thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the value would be substituted as &#34;true&#34; as it had been polluted.</p> <p>### PoC Code ```js var keyget = require(&#34;keyget&#34;) keyget.set({}, &#39;__proto__.polluted&#39;, &#39;true&#39;); console.log(polluted); ```</p> https://cve.radiocsirt.org/vuln/ghsa-8mp8-28xh-r486 https://cve.radiocsirt.org/vuln/gsd-2020-28272 gsd-2020-28272 https://cve.radiocsirt.org/vuln/gsd-2020-28272