Merge Project

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Merge Project records in CISA KEV

No Merge Project vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

4 records

TI-2021-02590 CVE-2021-3645 · GHSA-cqqh-49mx-fq63

MEDIUM 45

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01429 Published 2021-09-10 Fixed in 1.0.2 CWE-1321

TI-2020-17302 CVE-2020-28499 · GHSA-7wpw-2hjm-89gp

MEDIUM 45

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01443 Published 2021-02-18 Fixed in 2.1.1 CWE-915

TI-2021-06090 CVE-2021-23397 · GHSA-42m6-g935-5vmq

MEDIUM 44

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00822 Published 2022-07-25 No fix listed CWE-1321

TI-2018-11811 CVE-2018-16469 · GHSA-f9cm-qmx5-m98h

LOW 36

The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01678 Published 2018-10-30 Fixed in 1.2.1 CWE-400