Vulnerability · Published Nov 12, 2020 · Assigned by Mend
CVE-2020-28270
Critical 9.8
In plain English
A critical-severity security flaw in object-hierarchy-access. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.8%top 9.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | object-hierarchy-access | 0.33.0 | GHSA-fxwf-45c7-4ppr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | object-hierarchy-access | 0.32.0, 0.31.0, 0.30.0, 0.29.1, 0.29.0, 0.28.0, 0.27.1, 0.27.0, 0.26.0, 0.25.2, 0.25.1, 0.25.0, 0.24.0, 0.23.0, 0.22.0, 0.21.0, 0.20.2, 0.20.1, 0.20.0, 0.19.0, 0.18.0, 0.17.0, 0.16.0, 0.15.0, 0.14.1, 0.13.1, 0.12.0, 0.11.0, 0.10.0, 0.9.0, 0.8.0, 0.7.3, 0.7.2, 0.6.0, 0.5.2, 0.5.1, 0.4.3, 0.4.2, 0.4.1, 0.4.0, 0.2.0 |