-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mout | npm | <= 1.2.3 | 1.2.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the 'set' function's handling of property keys. The commit diff shows critical changes in src/object/set.js where the 'prop' parameter is explicitly converted to a string and checked for prototype pollution patterns. The added test case in tests/spec/object/spec-set.js demonstrates protection against array-based prototype pollution vectors. While vulnerability descriptions mention deepFillIn/deepMixIn, the actual fix and PoC target the 'set' function, indicating it was the primary vulnerable entry point. The previous CVE-2020-7792 addressed deepMixIn/deepFillIn, making this a new vulnerability in a different function.
JavaScriptJavaScriptOngoing coverage of React2Shell