In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.01987·Published 2019-10-24·Fixed in 0.14.0CWE-79