PT-2020-19754 · Unknown · Safetydance

Nerdjs · CVE-2020-7737 · Published 2020-10-02 · Updated 2022-12-02

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions safetydance versions all

Description The issue concerns Prototype Pollution via the set function. This affects all versions of the package, allowing for potential manipulation of object properties.

Recommendations For all versions, consider disabling the set function as a temporary workaround until a patch is available. Restrict access to the set function to minimize the risk of exploitation.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2020-7737

GHSA-6M85-WVCR-PGW3

Affected Products

Safetydance

References · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-SAFETYDANCE-598687 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7737 · Security Note
• https://osv.dev/vulnerability/GHSA-6m85-wvcr-pgw3 · Vendor Advisory
• https://github.com/gramakri/safetydance · Note
• https://t.me/cibsecurity/15009 · Telegram Post
• https://npmjs.com/package/safetydance · Note