-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unvalidated 'k' variable in Object.keys(shims).forEach loop within separateExposeGlobals. The GitHub patch adds explicit checks to skip 'proto' and 'constructor' keys, confirming this was the attack vector. The CVE description and commit diff both point to this function as the vulnerable code path that permitted prototype pollution through shim key manipulation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| browserify-shim | npm | <= 3.8.15 | 3.8.16 |