Critical severity9.8OSV Advisory· Published Dec 29, 2020· Updated Jun 17, 2026
CVE-2020-28278
CVE-2020-28278
Description
Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
shvlnpm | >= 1.0.0, < 2.0.2 | 2.0.2 |
Affected products
3- Range: v1.0.0, v1.1.0, v1.1.1, …
Patches
Vulnerability mechanics
References
8- github.com/robinvdvleuten/shvl/blob/bef0a3ebade444cc6b297147ecf5242308f0892e/index.jsnvdExploitThird Party Advisory
- github.com/advisories/GHSA-pqwc-3vhw-qcvqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-28278ghsaADVISORY
- www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28278nvdBroken LinkThird Party Advisory
- github.com/robinvdvleuten/shvl/commit/513c0848774dfb114ad0d0554abf7927cfdd569eghsaWEB
- github.com/robinvdvleuten/shvl/issues/34ghsaWEB
- github.com/robinvdvleuten/shvl/pull/36ghsaWEB
- web.archive.org/web/20210320222933/https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28278ghsaWEB
News mentions
0No linked articles in our index yet.