Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs | Nov 15, 2022 | Feb 24, 2022 |
| Alpine Linux | — | Upgrade openjdk11Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Feb 24, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade v8-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libs | Feb 17, 2025 | Jan 10, 2022 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-full-i18n | Nov 9, 2022 | Feb 24, 2022 |
| Debian | — | Upgrade nodejs | Oct 7, 2022 | Feb 24, 2022 |
| Freebsd | — | Upgrade mysql-client80Upgrade mysql-server56Upgrade mysql-server57Upgrade nodeUpgrade mysql-server80Upgrade node16Upgrade node14 | Nov 4, 2022 | Jul 21, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Feb 24, 2022 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-docs | Nov 16, 2022 | Jan 10, 2022 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docs | Nov 9, 2022 | Feb 24, 2022 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-devel | Mar 12, 2024 | Feb 24, 2022 |
| Suse | — | Upgrade nodejs10-docsUpgrade npm12Upgrade nodejs12-develUpgrade nodejs10Upgrade nodejs14-docsUpgrade nodejs12Upgrade nodejs10-develUpgrade nodejs14-develUpgrade npm10Upgrade nodejs12-docsUpgrade npm14Upgrade nodejs14 | Feb 11, 2022 | Feb 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub