CVE-2019-20149

Description

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

References

https://github.com/CQ-Tools/CVE-2019-20149-unfixed

https://github.com/CQ-Tools/CVE-2019-20149-fixed

https://github.com/advisories/GHSA-6c8f-qphg-qjgp

https://github.com/jonschlinkert/kind-of/pull/31

https://github.com/jonschlinkert/kind-of/issues/30

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS