CVE-2022-24279: Prototype Pollution

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-15 · updated 2026-06-17
Weakness: CWE-1321

Description

The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)

Affected products

madlib-object-utils: before 0.1.8 — fixed in 0.1.8

How to fix

Upgrade to a fixed version: madlib-object-utils 0.1.8. Check the vendor advisory for mitigations.

References

https://github.com/Qwerios/madlib-object-utils/commit/8d5d54c11c8fb9a7980a99778329acd13e3ef98f
https://snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-2388572
https://github.com/Qwerios/madlib-object-utils/commit/8d5d54c11c8fb9a7980a99778329acd13e3ef98f
https://snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-2388572

Get alerted when CVE-2022-24279 or the next vulnerability affects your stack