PT-2022-9026 · Unknown · Hughsk Flat

Hughsk · Published 2022-12-25 · Updated 2024-05-17 · CVE-2020-36632

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions hughsk flat versions up to 5.0.0

Description A critical vulnerability was found in hughsk flat, affecting the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes, known as 'prototype pollution'. It is possible to initiate the attack remotely.

Recommendations For versions up to 5.0.0, upgrade to version 5.0.1 to address this issue. As a temporary workaround, consider disabling the unflatten function until a patch is available.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2020-36632

GHSA-2J2X-2GPW-G8FM

Affected Products

Hughsk Flat

References · 19

• https://github.com/hughsk/flat/commit/20ef0ef55dfa028caddaedbcb33efbdb04d18e13 · Patch
• https://github.com/hughsk/flat/releases/tag/5.0.1 · Patch
• https://github.com/hughsk/flat/pull/106 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-36632 · Security Note
• https://osv.dev/vulnerability/GHSA-2j2x-2gpw-g8fm · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36632 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36632 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36632 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36632 · Vendor Advisory
• https://github.com/hughsk/flat/compare/4.1.0...4.1.1 · Note
• https://github.com/hughsk/flat/compare/v1.6.0...1.6.2 · Note
• https://github.com/hughsk/flat/compare/v2.0.1...2.0.2 · Note
• https://github.com/hughsk/flat/compare/3.0.0...3.0.1 · Note
• https://github.com/hughsk/flat/issues/105 · Note
• https://github.com/hughsk/flat · Note