Prototype pollution in object-hierarchy-access

CRITICAL 9.8CVE-2020-28270 · GHSA-fxwf-45c7-4ppr · Published 12/11/2020 · updated 17/06/2026

In short

CVE-2020-28270 is a CRITICAL (CVSS 9.8) vulnerability affecting object-hierarchy-access (mjpclab), object-hierarchy-access.
Chance of exploitation in the next 30 days (EPSS): 3.8%, higher than 90.2% of all vulnerabilities.
Fix: update to 0.33.0 or later.

Package	Affected versions	Patched versions
object-hierarchy-access mjpclab	`≥ 0.2.0, ≤ 0.32.0`	No fix yet
object-hierarchy-access npm	`≥ 0.2.0, < 0.33.0`	`0.33.0`

Description

Overview:Prototype pollution vulnerability in ‘object-hierarchy-access’ versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.

NVD description

Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.

References

nvd.nist.gov/vuln/detail/CVE-2020-28270 · ADVISORY
mjpclab/object-hierarchy-access commit 7b1aa13 · WEB
mjpclab/object-hierarchy-access · PACKAGE
whitesourcesoftware.com/vulnerability-database/CVE-2020-28270 · WEB
whitesourcesoftware.com/vulnerability-database/CVE-2020-28270, · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free