class-transformer before 0.3.1 allow attackers to perform Prototype Pollution
published April 6, 2020
CVSS
—
EPSS
1%
Percentile
67.7
In the wild
Unconfirmed
What it is
class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01188 · 67.7th percentile
Published
2020-04-06T12:34Z
EPSS history
Timeline
06 APR 12:34Z
class-transformer before 0.3.1 allow attackers to perform Prototype Pollution