CVE-2022-37617 thlorenz browserify-shim vulnerable to prototype pollution
Prototype pollution in browserify-shim allows attackers to manipulate object prototypes, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-37617?
CVE-2022-37617 is a critical vulnerability in n/a, published on 11 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.
Weakness: CWE-1321
Which versions are affected by CVE-2022-37617?
2 open source packages ship an affected version, including browserify-shim. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
browserify-shim npm | All versions | 3.8.16 |
browserify-shim npm | All versions | 3.8.16 |
Products include Browserify-Shim Project Browserify-Shim.
How do I fix CVE-2022-37617?
Upgrade browserify-shim to 3.8.16 or later.
Is CVE-2022-37617 being exploited?
There is no known exploitation of CVE-2022-37617 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-866w-wm4h-95c6.