CVE-2020-24939 Prototype pollution in supermixer
Prototype pollution in Stampit supermixer allows attackers to modify object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-24939?
CVE-2020-24939 is a high-severity vulnerability in n/a, published on 16 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.
Weakness: CWE-1321
Which versions are affected by CVE-2020-24939?
2 open source packages ship an affected version, including supermixer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
supermixer npm | All versions | 1.0.5 |
supermixer npm | All versions | 1.0.5 |
Products include Stampit Supermixer.
How do I fix CVE-2020-24939?
Upgrade supermixer to 1.0.5 or later.
Is CVE-2020-24939 being exploited?
There is no known exploitation of CVE-2020-24939 in the wild and no public exploit code.
Sources
Also known as GHSA-7prf-vw4p-qr59.