Skip to content

Product

mozilla Convict vulnerabilities

3 published CVES affecting mozilla Convict, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
2
High
1
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest mozilla Convict CVEs

Newest publication first

  1. CVE-2023-0163 Prototype Pollution in convict

    Published
    HighCVSS 8.4 EPSS 0.27%

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, wh...

  2. CVE-2022-21190 Prototype Pollution

    Published
    CriticalCVSS 9.8 EPSS 4.0%

    This affects the package convict before 6.2.3. This is a bypass of CVE-2022-22143. The fix introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with proto or this.constructor.prototype. To bypass thi...

  3. CVE-2022-22143 Prototype Pollution

    Published
    CriticalCVSS 9.8 EPSS 2.2%

    The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. Note: This vulnerability derives from an incomplete fix of another vulnerability

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.