Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Merge Project Component: Merge Clear all filters
TI-2021-06090 CVE-2021-23397 · GHSA-42m6-g935-5vmq

Prototype pollution in @ianwalter/merge

Priority MEDIUM 44

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00822 Published 2022-07-25 No fix listed CWE-1321
TI-2021-02590 CVE-2021-3645 · GHSA-cqqh-49mx-fq63

Prototype Pollution in viking04/merge

Priority MEDIUM 45

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01429 Published 2021-09-10 Fixed in 1.0.2 CWE-1321
TI-2020-17302 CVE-2020-28499 · GHSA-7wpw-2hjm-89gp

Prototype pollution in merge

Priority MEDIUM 45

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01443 Published 2021-02-18 Fixed in 2.1.1 CWE-915
TI-2018-11811 CVE-2018-16469 · GHSA-f9cm-qmx5-m98h

Uncontrolled resource consumption in HackerOne merge

Priority LOW 36

The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01678 Published 2018-10-30 Fixed in 1.2.1 CWE-400