Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-7718

CVE-2020-7718: Prototype Pollution in gammautils

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-7718
GHSA ID
GHSA-pgmg-gf5p-54j8
EPSS Score
0.60516%
CWE
CWE-1321
Published
5/6/2021
Updated
9/7/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
gammautilsnpm<= 0.0.81

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. Both advisory sources (GitHub, NVD, Snyk) explicitly name deepSet and deepMerge as vulnerable entry points.
  2. The PoC demonstrates pollution through both functions:
    • deepSet('proto.polluted2', ...)
    • deepMerge() with proto payload
  3. Prototype pollution typically occurs when:
    • Path traversal (deepSet) allows accessing magic properties
    • Recursive merges (deepMerge) copy prototype properties
  4. High confidence due to:
    • Multiple authoritative sources concurring
    • Clear PoC demonstrating exploitability
    • Alignment with known prototype pollution patterns in JS

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ll v*rsions o* p**k*** **mm*utils up to *n* in*lu*in* v*rsion *.*.** *r* vuln*r**l* to Prototyp* Pollution vi* t** `***pS*t` *n* `***pM*r**` *un*tions.

Reasoning

*. *ot* **visory sour**s (*it*u*, NV*, Snyk) *xpli*itly n*m* ***pS*t *n* ***pM*r** *s vuln*r**l* *ntry points. *. T** Po* **monstr*t*s pollution t*rou** *ot* *un*tions: - ***pS*t('__proto__.pollut***', ...) - ***pM*r**() wit* __proto__ p*ylo**