Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemon | Nov 15, 2022 | Feb 24, 2022 |
| Alpine Linux | — | Upgrade openjdk11Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Feb 24, 2022 |
| Amazon_linux_2023 | — | Upgrade v8-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-docs | Feb 17, 2025 | Jan 10, 2022 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-docs | Nov 9, 2022 | Feb 24, 2022 |
| Debian | — | Upgrade nodejs | Oct 7, 2022 | Feb 24, 2022 |
| Freebsd | — | Upgrade node16Upgrade node14Upgrade mysql-server80Upgrade mysql-server56Upgrade mysql-server57Upgrade nodeUpgrade mysql-client80 | Nov 4, 2022 | Jul 21, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Feb 24, 2022 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packaging | Nov 16, 2022 | Jan 10, 2022 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-packaging | Nov 9, 2022 | Feb 24, 2022 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejsUpgrade nodejs-full-i18n | Mar 12, 2024 | Feb 24, 2022 |
| Suse | — | Upgrade nodejs10-develUpgrade nodejs10Upgrade nodejs12-develUpgrade nodejs10-docsUpgrade nodejs14-docsUpgrade nodejs12Upgrade npm12Upgrade nodejs14-develUpgrade npm10Upgrade nodejs14Upgrade nodejs12-docsUpgrade npm14 | Feb 11, 2022 | Feb 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub