CVE-2023-45811CWE-1321

Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator

High · published October 17, 2023

CVSS v3.1
8.2
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in `[email protected]`. Users are advised to upgrade. Users unable to upgrade should launch node with the [--disable-proto=delete][disable-proto] or [--disable-proto=throw][disable-proto] flags

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2023-10-17T22:37Z
EPSS history
Timeline
  • 17 OCT 22:37Z
    Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator
    cvelistv5