CVE-2023-30857

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-30857
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-30857.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-30857
Aliases
Related
Published
2023-04-28T21:15:09Z
Modified
2025-01-08T14:57:44.381188Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version 0.6.1, there is a possible prototype pollution issue for the MetadataRecord, when merged with a base class' metadata object, in meta decorator from the @aedart/support package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via meta(). Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version 0.6.1.

References

Affected packages

Git / github.com/aedart/ion

Affected ranges

Type
GIT
Repo
https://github.com/aedart/ion
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

0.*

0.1.0
0.1.1
0.2.0
0.3.0
0.3.1
0.4.0
0.5.0
0.6.0