CVE-2020-7774 Prototype Pollution
Prototype pollution in the y18n library allows attackers to modify object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7774?
CVE-2020-7774 is a high-severity vulnerability in Oracle Graalvm, published on 17 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
Weakness: CWE-1321
Which versions are affected by CVE-2020-7774?
6 open source packages ship an affected version, including y18n. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
y18n npm | All versions | 3.2.2 |
y18n npm | All versions | 3.2.2 |
y18n npm | From 4.0.0 | 4.0.1 |
y18n npm | From 4.0.0 | 4.0.1 |
y18n npm | From 5.0.0 | 5.0.5 |
y18n npm | From 5.0.0 | 5.0.5 |
Products include Oracle Graalvm, Siemens Sinec Infrastructure Network Services, Y18n Project Y18n.
How do I fix CVE-2020-7774?
Upgrade y18n to a fixed version for your release line: 3.2.2, 4.0.1 or 5.0.5.
Is CVE-2020-7774 being exploited?
There is no known exploitation of CVE-2020-7774 in the wild and no public exploit code.
Other vulnerabilities in Oracle Graalvm
- CVE-2025-50059 Security feature bypass in Oracle GraalVM Enterprise Edition
- CVE-2021-32803 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
- CVE-2021-32804 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
- CVE-2025-30749 Code injection in Oracle GraalVM Enterprise Edition
- CVE-2025-50106 Code injection in Oracle GraalVM Enterprise Edition
Sources
Also known as ALPINE-CVE-2020-7774, CLEANSTART-2026-SV85138, CLEANSTART-2026-UW35844, CLSA-2026-1782867615, DEBIAN-CVE-2020-7774, GHSA-c4w7-xm78-47vh and 2 more.