CVE-2020-7748 Prototype Pollution
An attacker can pollute the object prototype via the deepExtend function, potentially leading to code execution or privilege escalation in applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7748?
CVE-2020-7748 is a medium-severity vulnerability in @tsed/core, published on 20 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Weakness: CWE-1321
Which versions are affected by CVE-2020-7748?
2 open source packages ship an affected version, including @tsed/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@tsed/core npm | All versions | 5.65.7 |
@tsed/core npm | All versions | 5.65.7 |
Products include Ts.ed Project Ts.ed.
How do I fix CVE-2020-7748?
Upgrade @tsed/core to 5.65.7 or later.
Is CVE-2020-7748 being exploited?
There is no known exploitation of CVE-2020-7748 in the wild and no public exploit code.
Sources
Also known as GHSA-77xq-cpvg-7xm2, SNYK-JS-TSEDCORE-1019382.