What’s Vulnerable › Vulnerabilities
CVE-2020-7774: Prototype Pollution
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 69.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-11-17 · updated 2026-06-17
- Weakness: CWE-1321
Description
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
Affected products
- Oracle Corporation GraalVM Enterprise Edition: 19.3.5, 20.3.1.2, 21.0.0.2
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
- Y18N Project Y18N: before 3.2.2; from 5.0.0 before 5.0.5; 4.0.0 — fixed in 3.2.2, 5.0.5
- Npm Y18n: before 3.2.2; from 4.0.0 before 4.0.1; from 5.0.0 before 5.0.5; 4.0.0 — fixed in 3.2.2, 4.0.1, 5.0.5
How to fix
Upgrade to a fixed version: Siemens Sinec Infrastructure Network Services 1.0.1.1; Y18N Project Y18N 3.2.2, 5.0.5; Npm Y18n 3.2.2, 4.0.1, 5.0.5. Check the vendor advisory for mitigations.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://github.com/yargs/y18n/issues/96
- https://github.com/yargs/y18n/pull/108
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306
- https://snyk.io/vuln/SNYK-JS-Y18N-1021887
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://github.com/yargs/y18n/issues/96
- https://github.com/yargs/y18n/pull/108
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306
- https://snyk.io/vuln/SNYK-JS-Y18N-1021887
- https://www.oracle.com/security-alerts/cpuApr2021.html
Get alerted when CVE-2020-7774 or the next vulnerability affects your stack