CVE-2022-26260

Description

simple-plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().

How to fix CVE-2022-26260

To remediate CVE-2022-26260, upgrade the affected package to a fixed version below.

• npm/simple-plist—upgrade to 1.3.1 or later

Is CVE-2022-26260 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.3.1

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-26260
• PATCHgithub.com/wollardj/simple-plist
• WEBgithub.com/wollardj/simple-plist/commit/670e22fd6e46549a1d32d1065981e0f58eab98d6
• WEBgithub.com/wollardj/simple-plist/issues/60