CVE-2020-8125 json
Improper Input Validation in klona
published 2020-02-04 6 y ago modified 2026-06-17 4 mo ago also GHSA-8f89-2fwj-5v5r , EUVD-2021-0798
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.1%
- EPSS 4.1% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.
Patch / fix
Exploit prediction
4.12% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- hackerone.com https://hackerone.com/reports/778414 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | klona | <1.1.1 |
1.1.1 |
Affected products
- n/a klona npm module
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
hackerone.com
/reports/778414
web, exploit, patch, third-party-advisory
-
github.com
/lukeed/klona/commit/200e8d1fd383a54790ee6fc8228264c21954e38e
web
-
nvd.nist.gov
/vuln/detail/CVE-2020-8125
advisory
Sources
- CVE List CVE-2020-8125
- GitHub Advisory GHSA-8f89-2fwj-5v5r
- NVD CVE-2020-8125
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.