CVE-2022-37611: Prototype Pollution Vulnerability in gh-pages
Summary
CVE-2022-37611: tschaub gh-pages vulnerable to prototype pollution. Affects gh-pages versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gh-pages is an npm package that allows users to publish web pages directly from a GitHub repository. It simplifies the process of deploying static web pages by automating the creation of a branch specifically for hosting the pages. The package is widely used by developers to showcase their projects or host documentation.
Vulnerability Detail
The gh-pages package is vulnerable to prototype pollution, specifically in the util.js file. This vulnerability can be exploited by an attacker to modify the prototype of objects, leading to potential remote code execution or denial of service attacks. The vulnerability arises from improper handling of the 'partial' variable, allowing an attacker to inject malicious properties into the prototype chain.
How To Fix
Latest published version: 6.3.0 as of 23 Oct 2026
npm install gh-pages@6.3.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.0
This is the first release that contains the fix.
npm install gh-pages@5.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the latest version to mitigate the risk.
Conclusion
The prototype pollution vulnerability in gh-pages poses a significant risk to applications utilizing this package. It is crucial to update to version 5.0.0 or later to mitigate the risk of remote code execution or denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gh-pages →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of objects. By injecting malicious properties into the prototype chain, the attacker can manipulate the behavior of the affected code.
The prototype pollution vulnerability in gh-pages can lead to remote code execution or denial of service attacks. An attacker could modify the behavior of the application, potentially compromising user data or disrupting the functionality of the web pages hosted using gh-pages.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is crucial to update the package to the latest version to prevent any potential exploitation.
No, only versions prior to 5.0.0 are affected by this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
