CVE-2024-21548 | THREATINT

Description

Versions of the package bun before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects.

Reserved 2023-12-22 | Published 2024-12-18 | Updated 2024-12-18 | Assigner snyk

HIGH: 7.7CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:PHIGH: 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P

Problem types

Prototype Pollution

Credits

Liran Tal - Snyk Research Team

References

security.snyk.io/vuln/SNYK-JS-BUN-8499549

github.com/...ommit/a234e067a5dc7837602df3fb5489e826920cc65a

github.com/oven-sh/bun/pull/14119

cve.org (CVE-2024-21548)

nvd.nist.gov (CVE-2024-21548)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.