https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 19:41:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-46990 EUVD-2026-46990 https://cve.radiocsirt.org/vuln/euvd-2026-46990 https://cve.radiocsirt.org/vuln/fkie_cve-2020-28279 <p>Prototype pollution vulnerability in &#39;flattenizer&#39; versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.</p> <p>Prototype pollution vulnerability in &#39;flattenizer&#39; versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-28279 https://cve.radiocsirt.org/vuln/ghsa-vq33-26pr-r4h6 <p><strong>Affected:</strong> npm: flattenizer</p> <p>### Overview Prototype pollution vulnerability in ‘flattenizer’ versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.</p> <p>### Details The NPM module &#39;flattenizer&#39; can be abused by Prototype Pollution vulnerability since the function &#39;unflatten()&#39; did not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.</p> <p>### PoC Details There is no validation before assigning the property to check whether the assigned argument is the Object&#39;s own property or not, the property `polluted` will be directly be assigned thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the valued would be substituted as &#34;true&#34; as it had been polluted.</p> <p>```js var flattenizer = require(&#34;flattenizer&#34;) flattenizer.unflatten({&#39;__proto__.polluted&#39;: true}); console.log(polluted); ```</p> <p><strong>Affected:</strong> npm: flattenizer</p> <p>### Overview Prototype pollution vulnerability in ‘flattenizer’ versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.</p> <p>### Details The NPM module &#39;flattenizer&#39; can be abused by Prototype Pollution vulnerability since the function &#39;unflatten()&#39; did not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.</p> <p>### PoC Details There is no validation before assigning the property to check whether the assigned argument is the Object&#39;s own property or not, the property `polluted` will be directly be assigned thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the valued would be substituted as &#34;true&#34; as it had been polluted.</p> <p>```js var flattenizer = require(&#34;flattenizer&#34;) flattenizer.unflatten({&#39;__proto__.polluted&#39;: true}); console.log(polluted); ```</p> https://cve.radiocsirt.org/vuln/ghsa-vq33-26pr-r4h6 https://cve.radiocsirt.org/vuln/gsd-2020-28279 gsd-2020-28279 https://cve.radiocsirt.org/vuln/gsd-2020-28279