Prototype Pollution

published 2020-10-20 6 y ago modified 2026-07-08 4 mo ago also GHSA-77xq-cpvg-7xm2 , EUVD-2021-0990

cvss: 5.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits: 0; none known

This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

Patch / fix

fixed in 2 links 3

npm @tsed/core 5.65.7
n/a @tsed/core 5.65.7

github.com/TypedProject/tsed@1395773 commit
snyk.io/vuln/SNYK-JS-TSEDCORE-1019382 advisory
github.com/TypedProject/tsed/blob/production/packages/core/src/utils/… advisory

Exploit prediction

1.72% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

snyk.io https://snyk.io/vuln/SNYK-JS-TSEDCORE-1019382 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	3.1	5.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub	3.1	5.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
npm	@tsed/core	<5.65.7	5.65.7

Affected products

n/a @tsed/core

Classification

Weakness

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

References

github.com /TypedProject/tsed/commit/1395773ddac35926cf058fc6da9fb8e82266761b
web, patch, third-party-advisory
snyk.io /vuln/SNYK-JS-TSEDCORE-1019382
web, exploit, patch, third-party-advisory
github.com /TypedProject/tsed/blob/production/packages/core/src/utils/deepExtends.ts%23L36
web, broken-link, patch, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2020-7748
advisory
github.com /tsedio/tsed
package

Sources

CVE List CVE-2020-7748
GitHub Advisory GHSA-77xq-cpvg-7xm2
NVD CVE-2020-7748

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary