PT-2023-20514

CVE-2023-26135

Published

2023-06-30

Updated

2024-02-07

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions flatnest versions all

Description The issue concerns Prototype Pollution via the nest() function in the flatnest/nest.js file. This affects all versions of the package flatnest.

Recommendations For all versions, consider disabling the nest() function as a temporary workaround until a patch is available. Restrict access to the flatnest/nest.js file to minimize the risk of exploitation. Avoid using the nest() function in sensitive operations until the issue is resolved.

Exploitability

Exploit

Fix

Impacts

Researchers

Peng Zhou

Yuhan Gao

Vendors

Affected products

Weakness enumeration

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Related identifiers