High severity7.5NVD Advisory· Published Nov 15, 2020· Updated Jun 17, 2026
CVE-2020-28268
CVE-2020-28268
Description
Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
controlled-mergenpm | >= 1.0.0, < 1.3.0 | 1.3.0 |
Affected products
3- cpe:2.3:a:controlled-merge_project:controlled-merge:*:*:*:*:*:node.js:*:*Range: >=1.0.0,<=1.2.0
- controlled-merge/controlled-mergedescription
Patches
Vulnerability mechanics
References
5- github.com/hlfshell/controlled-merge/commit/5a4b2e9ffe5a0be7f8843d4ab038599d3ae5f9d4nvdPatchThird Party AdvisoryWEB
- www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28268nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-5pg7-v24c-9rp9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-28268ghsaADVISORY
- www.npmjs.com/package/controlled-mergeghsaWEB
News mentions
0No linked articles in our index yet.