-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the initialization of the 'Namespaces' object as a plain object with a prototype ({}). The commit fixes this by using Object.create(null), which creates a prototype-less object. The associated CWE-665 (Improper Initialization) and the patch's focus on socket.io's onMessage handling confirm that the message handler relied on this vulnerable object. Prototype pollution in this context allows attackers to inject malicious properties into the Namespaces object, leading to authentication bypass.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nodebb | npm | < 2.6.1 | 2.6.1 |
Ongoing coverage of React2Shell