-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @hapi/hoek | npm | < 8.5.1 | 8.5.1 |
| @hapi/hoek | npm | >= 9.0.0, < 9.0.3 | 9.0.3 |
| hoek | npm | <= 6.1.3 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability documentation explicitly states the clone() function is the entry point for prototype pollution. The GitHub commit diffs (4d0804b and 948baf9) show code changes in lib/clone.js where a check for 'proto' keys was added to prevent prototype pollution. The test case added in test/index.js specifically validates this fix by ensuring cloned objects don't inherit prototype properties from 'proto' keys. This direct correlation between the vulnerability description, CWE-1321 classification, and code changes confirms the clone function in lib/clone.js as the vulnerable component.
Ongoing coverage of React2Shell