Critical severity9.8NVD Advisory· Published Dec 2, 2020· Updated Jun 17, 2026

CVE-2020-28272

Description

Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
keygetnpm	>= 1.0.0, < 2.3.0	2.3.0

Affected products

Keyget Project/Keyget
cpe:2.3:a:keyget_project:keyget:*:*:*:*:*:node.js:*:*
Range: >=1.0.1,<=2.2.0
keyget/keygetdescription
ghsa-coords
pkg:npm/keyget
Range: >= 1.0.0, < 2.3.0

Patches

Vulnerability mechanics

References

github.com/rumkin/keyget/commit/17d15b6c75036eb429075a8cfeccfc18094dd2e2nvdPatchThird Party AdvisoryWEB
www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28272nvdExploitThird Party Advisory
github.com/advisories/GHSA-8mp8-28xh-r486ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-28272ghsaADVISORY
web.archive.org/web/20201207183211/https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28272ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000