GCVE - cpe:2.3:a:n/a:convict:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:n/a:convict:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	N/A (`22f567d3-1203-528c-8f0e-3eb9c2f6ca78`)
Product	Convict (`792b713f-2ea9-557c-8c4d-cf9ac18a7188`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-22143`	vulnerable	2026-06-08 05:40:06.046862	Prototype Pollution HIGH (7.5) The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. Note: This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508) Published: 2022-05-01T15:30:45.287Z Updated: 2024-09-17T02:02:16.928Z Open on db.gcve.eu Reference links https://snyk.io/vuln/SNYK-JS-CONVICT-2340604 https://github.com/mozilla/node-convict/blob/5eb1314f85346760a3c31cb14510f2f0af11d0d3/packages/convict/src/main.js%23L569 https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-21190`	vulnerable	2026-06-08 05:39:59.970336	Prototype Pollution HIGH (7.5) This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.__proto__ or foo.this.constructor.prototype. Published: 2022-05-13T20:00:38.749Z Updated: 2024-09-17T03:32:50.471Z Open on db.gcve.eu Reference links https://snyk.io/vuln/SNYK-JS-CONVICT-2774757 https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571 https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808 https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07 https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.