TI-2022-09426 Aliases CVE-2022-25862 GHSA-ph28-wwfj-fv7f

Prototype pollution in sds

LOW 34CWE-1321Published 2022-05-13 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-7618](https://security.snyk.io/vuln/SNYK-JS-SDS-564123)

Why it matters now

EPSS 0.00737 54th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	sds	0.0.0 and later	—	No fix listed	CNA
—	sds (npm)	up to 4.4.0	—	No fix listed	GHSA-ph28-wwfj-fv7f

sds Vendor— Affected 0.0.0 and later Fixed in — No fix listed CNA
sds (npm) Vendor— Affected up to 4.4.0 Fixed in — No fix listed GHSA-ph28-wwfj-fv7f

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sds_project:sds::::::node.js::*	all versions	Vulnerable	Sds Project

cpe:2.3:a:sds_project:sds:*:*:*:*:*:node.js:*:* Versions all versions Vulnerable ·Sds Project

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-25862
2026-10-03 Alias added: GHSA-ph28-wwfj-fv7f

References

Advisory 3

Other 1

https://github.com/monsterkodi/sds

TI-2020-06139 Prototype pollution in sds CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences