-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dref | npm | <= 0.1.2 |
Miggo AIRoot Cause AnalysisThe analysis is based on the provided vulnerability description and the information from the Gist URL. The Gist provides a clear Proof of Concept (PoC) that demonstrates the prototype pollution vulnerability in the set function of the dref library. The PoC shows that calling lib.set(someObj, "__proto__.pollutedKey", 123) pollutes the object prototype. Although the source code of the package could not be retrieved, the detailed description and PoC from the Gist provide high confidence in identifying the vulnerable function as set in lib/index.js.
Ongoing coverage of React2Shell