What is GHSA-42m6-g935-5vmq?

GHSA-42m6-g935-5vmq is a security advisory published by GitHub Security Advisories with Medium severity. @ianwalter/merge Prototype Pollution via `merge` function

Which CVE IDs does GHSA-42m6-g935-5vmq cover?

GHSA-42m6-g935-5vmq covers the following CVE IDs: CVE-2021-23397. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-42m6-g935-5vmq?

GHSA-42m6-g935-5vmq has a CVSS v3 base score of 5.6, published by GitHub Security Advisories.

Which products are affected by GHSA-42m6-g935-5vmq?

GHSA-42m6-g935-5vmq affects 1 product, including: npm/@ianwalter/merge:\u003c= 9.0.1.

GHSA-42m6-g935-5vmqMediumCVSS 5.6

@ianwalter/merge Prototype Pollution via `merge` function

Vendor

GitHub Security Advisories

Published

July 26, 2022

Last Modified

January 31, 2023

🔗 CVE IDs covered (1)

CVE-2021-23397 →

📋 Description

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. @ianwalter/merge is deprecated and the maintainer suggests using @generates/merger instead.

🎯 Affected products1

npm/@ianwalter/merge:<= 9.0.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2021-23397
https://security.snyk.io/vuln/SNYK-JS-IANWALTERMERGE-1311022
https://github.com/advisories/GHSA-42m6-g935-5vmq