CVE-2023-38894

Description

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.

How to fix CVE-2023-38894

To remediate CVE-2023-38894, upgrade the affected package to a fixed version below.

• npm/tree-kit—upgrade to 0.7.5 or later

Is CVE-2023-38894 being exploited?

Low — EPSS is 2.7%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.7.5

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-38894
• PATCHgithub.com/cronvel/tree-kit
• WEBgithub.com/cronvel/tree-kit/commit/61bf10cf0dbddaeea3f198cfe7cb469f360d82bc
• WEBwww.code-intelligence.com/blog/treekit-prototype-pollution-cve-2023-38894
• WEB