-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rfc6902 | npm | < 5.0.0 | 5.0.0 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from the token-processing loop in Pointer's implementation. The pre-patch code in pointer.ts iterated through path tokens and directly assigned values using value = (parent || {})[key] without checking for dangerous keys. The patch adds a guard clause to skip proto/constructor/prototype keys, confirming this was the injection point. The evaluate method (implied by the token traversal logic) is responsible for resolving JSON pointers, making it the logical location for this prototype pollution vulnerability.
Ongoing coverage of React2Shell