Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZjOGYtcXBoZy1xamdw

Validation Bypass in kind-of

Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.

Recommendation

Upgrade to versions 6.0.3 or later.

Permalink: https://github.com/advisories/GHSA-6c8f-qphg-qjgp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZjOGYtcXBoZy1xamdw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 5 years ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Percentage: 0.00089
EPSS Percentile: 0.39501

Identifiers: GHSA-6c8f-qphg-qjgp, CVE-2019-20149
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-20149
• https://github.com/jonschlinkert/kind-of/issues/30
• https://github.com/jonschlinkert/kind-of/pull/31
• https://github.com/jonschlinkert/kind-of/commit/1df992ce6d5a1292048e5fe9c52c5382f941ee0b
• https://snyk.io/vuln/SNYK-JS-KINDOF-537849
• https://www.npmjs.com/advisories/1490
• https://github.com/advisories/GHSA-6c8f-qphg-qjgp

Repository: https://github.com/jonschlinkert/kind-of
Blast Radius: 47.5

Affected Packages