Log in Start free

Vulnerability · Published May 1, 2022 · Assigned by snyk

CVE-2022-21189Prototype Pollution

High 7.3

In plain English

A high-severity security flaw in dexie. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.7%top 22.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This can allow an attacker to add/modify properties of the Object.prototype leading to prototype pollution vulnerability. **Note:** This vulnerability can occur in multiple ways, for example when modifying a collection with untrusted user input.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmdexie3.2.2GHSA-3xgx-r9j4-qw9w
npmdexie4.0.0-alpha.3GHSA-3xgx-r9j4-qw9w

Affected products (as reported)

VendorProductVersions
n/a dexie unspecified – before 3.2.24.0.0-alpha.1 – before unspecifiedunspecified – before 4.0.0-alpha.3

References