PT-2022-24026 · Unknown · Tschaub Gh-Pages

Secdevlpr26 · Published 2022-10-12 · Updated 2025-05-15 · CVE-2022-37611

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tschaub gh-pages version 3.1.0

Description The issue is related to a prototype pollution vulnerability. It is exploited via the partial variable in util.js.

Recommendations For tschaub gh-pages version 3.1.0, consider restricting access to the partial variable in util.js to minimize the risk of exploitation. As a temporary workaround, avoid using the partial variable in util.js until a patch is available.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-37611

GHSA-8MMM-9V2Q-X3F9

Affected Products

Tschaub Gh-Pages

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-37611 · Security Note
• https://osv.dev/vulnerability/GHSA-8mmm-9v2q-x3f9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37611 · Vendor Advisory
• https://github.com/tschaub/gh-pages/pull/452 · Note
• https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L11 · Note
• https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L16 · Note
• https://github.com/tschaub/gh-pages · Note
• https://github.com/tschaub/gh-pages/issues/446 · Note
• https://t.me/cvenotify/122338 · Telegram Post