CVE-2020-8125

Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.

Affected

klona npm module

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

4.12% chance of exploitation in the next 30 days, 91st percentile

Published

2020-02-04

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://hackerone.com/reports/778414

Security advisories

• advisories/GHSA-8f89-2fwj-5v5r

References

• CVE Record
• NVD entry