-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| deobfuscator | npm | >= 2.0.1, < 2.4.4 | 2.4.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the LiteralMap transformer's use of prototype-inherited object storage (map: { [x: string]: { [x: string]: any } } = {}) in the demap function. This allowed attackers to pollute Object.prototype through proto properties. The proof of concept shows that setting proto.parser triggers Prettier's require() call. The fix replaced the vulnerable object with a Map (new Map<string, Map<string, any>>()), which prevents prototype chain pollution. The commit diff shows this critical change in literalmap.ts, confirming this was the vulnerable component.
Ongoing coverage of React2Shell