GHSA-wwxh-74fx-33c6

    Dashboard / Vulnerabilities / GHSA-wwxh-74fx-33c6

    GHSA-wwxh-74fx-33c6

    Published: 1 May 2023Last Modified: 10 Sept 2026

    Summary: Possible prototype pollution in metadata record, when using meta decorator

    Details: ### Impact Possible prototype pollution for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood is questionable, given that a class' metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can become a vulnerability. ### Patches Has been patched in version `0.6.1`.

    References: https://github.com/aedart/ion/security/advisories/GHSA-wwxh-74fx-33c6, https://nvd.nist.gov/vuln/detail/CVE-2023-30857, https://github.com/aedart/ion/commit/c3e2ee08710d4164d796ecb66ed291335dae9291, https://github.com/aedart/ion

    Affected packages

    Package

    Name: @aedart/support

    Purl: pkg:npm/%40aedart/support

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.6.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-wwxh-74fx-33c6 | CVE-DB