npm tree-kit vulnerabilities

Latest npm tree-kit CVEs

Newest publication first

1. CVE-2023-38894 tree-kit Prototype Pollution vulnerability

   Published 2023-08-16

   Critical·CVSS 9.8 EPSS 1.7%

   A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.

2. CVE-2021-4278 cronvel tree-kit prototype pollution

   Published 2022-12-25

   High·CVSS 7.8 EPSS 0.45%

   A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to addre...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.