CVE-2024-21548

HIGH

7.5

Beschreibung

Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. **Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past.

CVE Details

CVSS v3.1 Bewertung7.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatHIGH

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht12/18/2024

Zuletzt geandert4/29/2026

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-1321CWE-1321

Referenzen

https://github.com/oven-sh/bun/commit/a234e067a5dc7837602df3fb5489e826920cc65a(report@snyk.io)

https://github.com/oven-sh/bun/pull/14119(report@snyk.io)

https://security.snyk.io/vuln/SNYK-JS-BUN-8499549(report@snyk.io)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.