The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Noroxi assessment

Priority: This week (action score 60/100)

• The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
• Probability of exploitation in the next 30 days: 69.3% (FIRST EPSS); higher than 99.3% of all records.
• Anyone who can reach it over the internet can trigger it. No account or password is required. No user action is required. No special conditions are required; it is repeatable.
• Fixed version: nodejs-nodemon (AlmaLinux:8) 1.18.3-1.module_el8.3.0+2047+b07ac28e, 1.18.3-1.module_el8.3.0+2023+d2377ea3, 2.0.3-1.module_el8.4.0+2521+c668cc9f; nodejs-packaging (AlmaLinux:8) 23-3.module_el8.4.0+2522+3bd42762, 17-3.module_el8.4.0+2224+b07ac28e, 17-3.module_el8.4.0+2521+c668cc9f; nodejs (Alpine:v3.10) 10.24.1-r0.
• Severity is disputed: the assigning authority (CNA) scores it 7.3, NVD 9.8.
• Mentioned 4 times in Turkish national cyber security advisories (siberguvenlik.gov.tr).

Don’t wait for the next maintenance window. Upgrade to nodejs-nodemon (AlmaLinux:8) 1.18.3-1.module_el8.3.0+2047+b07ac28e, 1.18.3-1.module_el8.3.0+2023+d2377ea3, 2.0.3-1.module_el8.4.0+2521+c668cc9f; nodejs-packaging (AlmaLinux:8) 23-3.module_el8.4.0+2522+3bd42762, 17-3.module_el8.4.0+2224+b07ac28e, 17-3.module_el8.4.0+2521+c668cc9f; nodejs (Alpine:v3.10) 10.24.1-r0 or later.

Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it

Primary sources: NVD · CVE.org · FIRST EPSS