CVE-2022-37257

CRITICAL9.8EPSS 0.51%

steal vulnerable to Prototype Pollution via requestedVersion variable

Published: 9/16/2022Modified: 11/8/2023

Description

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal via the requestedVersion variable in the npm-convert.js file.

Affected packages (1)

npm/stealfrom 0, <= 2.3.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-37257
PATCHhttps://github.com/stealjs/steal
WEBhttps://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/npm-convert.js#L362
WEBhttps://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/npm-convert.js#L371
WEBhttps://github.com/stealjs/steal/issues/1526