Vulnerability · Published Dec 25, 2022 · Assigned by VulDB

CVE-2021-4278cronvel tree-kit prototype pollution

Medium 5.5

In plain English

A medium-severity prototype pollution in tree-kit from cronvel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.4%top 61.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to address this issue. The name of the patch is a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. It is recommended to upgrade the affected component. The identifier VDB-216765 was assigned to this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	tree-kit	0.7.0	GHSA-mw4x-g2x8-qcvf

Affected products (as reported)

Vendor	Product	Versions
cronvel	tree-kit	0.10.20.30.40.50.6

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.216765 vdb-entry
https://vuldb.com/?ctiid.216765 signature, permissions-required
https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd patch
https://github.com/cronvel/tree-kit/releases/tag/v0.7.0 patch