Prototype pollution in controlled-merge

HIGH 7.5CVE-2020-28268 · GHSA-5pg7-v24c-9rp9 · Published 15/11/2020 · updated 17/06/2026

In short

CVE-2020-28268 is a HIGH (CVSS 7.5) vulnerability affecting controlled-merge (controlled-merge project), controlled-merge.
Chance of exploitation in the next 30 days (EPSS): 3.6%, higher than 89.4% of all vulnerabilities.
Fix: update to 1.3.0 or later.

Package	Affected versions	Patched versions
controlled-merge controlled-merge_project	`≥ 1.0.0, ≤ 1.2.0`	No fix yet
controlled-merge npm	`≥ 1.0.0, < 1.3.0`	`1.3.0`

Description

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.

NVD description

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.

References

nvd.nist.gov/vuln/detail/CVE-2020-28268 · ADVISORY
hlfshell/controlled-merge commit 5a4b2e9 · WEB
npmjs.com/package/controlled-merge · WEB
whitesourcesoftware.com/vulnerability-database/CVE-2020-28268 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free