要点
- CVE-2019-20149 是影响 kind-of (kind-of project), kind-of 的高危 (CVSS 7.5)漏洞。
- 未来 30 天内被利用的概率（EPSS）：2.3%，高于 83.7% 的漏洞。
- 修复：升级到 6.0.3 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| kind-of | = 6.0.2
| No fix yet |
| kind-of npm | ≥ 6.0.0, < 6.0.3
| 6.0.3
|
Description
Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.
Recommendation
Upgrade to versions 6.0.3 or later.
NVD description
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free