CVE-2022-46164 in the critical feed json
Account takeover via prototype vulnerability
published 2022-12-05 3 y ago modified 2026-06-17 4 mo ago also GHSA-rf3g-v8p5-p675 , EUVD-2022-7733
- cvss
- 9.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 47.4%
- EPSS 47.4% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.
Patch / fix
- npm nodebb 2.6.1
- nodebb nodebb 2.6.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
47.37% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | nodebb | <2.6.1 |
2.6.1 |
Affected products
- NodeBB NodeBB
Classification
- Weakness
-
- CWE-665 Improper Initialization
References
-
github.com
/NodeBB/NodeBB/commit/48d143921753914da45926cca6370a92ed0c46b8
web, patch, third-party-advisory
-
github.com
/NodeBB/NodeBB/security/advisories/GHSA-rf3g-v8p5-p675
web, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-46164
advisory
-
github.com
/NodeBB/NodeBB
package
-
github.com
/NodeBB/NodeBB/releases/tag/v2.6.1
web
Sources
- CVE List CVE-2022-46164
- GitHub Advisory GHSA-rf3g-v8p5-p675
- NVD CVE-2022-46164
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.