CVE-2020-7706: Prototype Pollution in connie-lang
Summary
CVE-2020-7706: Prototype Pollution in connie-lang. Affects connie-lang versions < 0.1.1. Fixed in 0.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The connie-lang package is an npm package that provides a configuration language library used by connie. It allows users to define and manage configurations for their applications. However, versions before 0.1.1 of connie-lang are vulnerable to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can inject properties into existing JavaScript objects. In the case of connie-lang, an attacker can manipulate the configuration language library to modify or add properties to objects, potentially leading to unauthorized access, data tampering, or denial of service. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
0.1.1
This is the first release that contains the fix.
npm install connie-lang@0.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The connie-lang package before version 0.1.1 is vulnerable to Prototype Pollution. It is recommended to update to version 0.1.1 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for connie-lang →
FAQ
Connie-lang is an npm package that provides a configuration language library used by connie. It allows users to define and manage configurations for their applications.
Prototype Pollution is a vulnerability that occurs when an attacker can inject properties into existing JavaScript objects. It can lead to unauthorized access, data tampering, or denial of service.
Versions before 0.1.1 of connie-lang are vulnerable to Prototype Pollution. An attacker can manipulate the configuration language library to modify or add properties to objects, potentially leading to security issues.
This vulnerability has a CVSS score of 9.8, indicating its critical severity.
To fix this vulnerability, update connie-lang to version 0.1.1 or later by running the command 'npm install connie-lang@0.1.1'.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
