CVE-2023-45811

Katalog CVE

CVSS 7.8 · High EPSS 0,42%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada relative synchrony. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in `deobfuscator@2.4.4`. Users are advised to upgrade. Users unable to upgrade should launch node with the [--disable-proto=delete][disable-proto] or [--disable-proto=throw][disable-proto] flags

Rincian

Terbit di NVD

17 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/relative/synchrony/security/advisories/GHSA-jg82-xh3w-rhxx exploit · advisory vendor
• https://github.com/relative/synchrony/commit/b583126be94c4db7c5a478f1c5204bfb4162cf40 patch
• https://github.com/relative/synchrony/security/advisories/src/transformers/literalmap.ts broken link