CVE-2022-1295:
Prototype Pollution in fullpage.js
7.3
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.66973%
CWE
Published
4/12/2022
Updated
1/27/2023
KEV Status
No
Technology
JavaScript
Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
fullpage.js | npm | < 4.0.2 | 4.0.2 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability documentation explicitly identifies deepExtend
as the vulnerable utility function. Prototype pollution vulnerabilities typically occur in deep merge functions that don't validate()
if target properties are legitimate object properties versus prototype chain properties. The CWE-1321 mapping and advisory context confirm this is a classic case of unsafe recursive object property merging.