Prototype Pollution in dotty

심각 9.8CVE-2021-23624 · GHSA-6g47-63mv-qpgh · SNYK-JS-DOTTY-1577292 · Published 03/11/2021 · updated 17/06/2026

요약

CVE-2021-23624은(는) dotty (dotty project), dotty에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.3%, 전체 취약점의 70.2%보다 높음.
조치: 0.1.2 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
dotty dotty_project	`< 0.1.2`	`0.1.2`
dotty npm	`< 0.1.2`	`0.1.2`

Description

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.

NVD description

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.

References

nvd.nist.gov/vuln/detail/CVE-2021-23624 · ADVISORY
deoxxa/dotty commit 88f6186 · WEB
deoxxa/dotty · PACKAGE
snyk.io/vuln/SNYK-JS-DOTTY-1577292 · WEB

dotty의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free