-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| immer | npm | >= 7.0.0, < 9.0.6 | 9.0.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from path element processing in applyPatches_ where path[i] could be an array (e.g., ['proto']). The strict equality check (p === 'proto') fails because array vs string type mismatch, allowing prototype pollution. The patch converts path[i] to string ('' + path[i]), confirming the vulnerable code was in this path processing loop. The test case added in tests/patch.js directly targets this scenario, and the CVE description explicitly references the applyPatches_ function's condition check as the vulnerable point.
JavaScriptJavaScriptOngoing coverage of React2Shell