npm package
immer
pkg:npm/immer
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-3757 | Cri | 9.8 | >= 7.0.0, < 9.0.6 | 9.0.6 | Sep 2, 2021 | immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | |
| CVE-2021-23436 | Med | 5.6 | >= 7.0.0, < 9.0.6 | 9.0.6 | Sep 1, 2021 | This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "construc | |
| CVE-2020-28477 | Hig | 7.5 | >= 7.0.0, < 8.0.1 | 8.0.1 | Jan 19, 2021 | This affects all versions of package immer. |
- affected >= 7.0.0, < 9.0.6fixed 9.0.6
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- affected >= 7.0.0, < 9.0.6fixed 9.0.6
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "construc
- affected >= 7.0.0, < 8.0.1fixed 8.0.1
This affects all versions of package immer.