← All advisories

Critical severity9.8NVD Advisory· Published Aug 16, 2023· Updated Jul 9, 2026

CVE-2023-38894

CVE-2023-38894

Description

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
tree-kitnpm	< 0.7.5	0.7.5

Affected products

3

Cronvel/Tree-kitdescription
ghsa-coords
pkg:npm/tree-kit
Range: < 0.7.5
Tree Kit Project/Tree Kit
cpe:2.3:a:tree_kit_project:tree_kit:*:*:*:*:*:node.js:*:*
Range: <=0.7.4

Patches

Vulnerability mechanics

References

5

www.code-intelligence.com/blog/treekit-prototype-pollution-cve-2023-38894nvdExploitWEB
github.com/advisories/GHSA-5p42-m6f3-hpmjghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-38894ghsaADVISORY
tree-kit.comghsaWEB
github.com/cronvel/tree-kit/commit/61bf10cf0dbddaeea3f198cfe7cb469f360d82bcghsaWEB

News mentions

0

No linked articles in our index yet.