Kurz gesagt
- CVE-2019-20149 ist eine Schwachstelle (HOCH (CVSS 7.5)) in kind-of (kind-of project), kind-of.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.3%, höher als bei 83.7% aller Schwachstellen.
- Abhilfe: auf 6.0.3 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| kind-of | = 6.0.2
| No fix yet |
| kind-of npm | ≥ 6.0.0, < 6.0.3
| 6.0.3
|
Description
Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.
Recommendation
Upgrade to versions 6.0.3 or later.
NVD description
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free