Typestack Class-validator Project Typestack Class-validator 0.10.2

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:typestack_class-validator_project:typestack_class-validator:0.10.2:*:*:*:*:*:*:*

part: a version: 0.10.2 update: *

VendorTypestack Class Validator Project (7855720c-732c-58b7-ac65-e10fbae52e5e)
ProductTypestack Class Validator (4b7f8878-fd6c-5c44-ab15-cd6d03e6decf)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/typestack/class-validator purl2cpe 2026-06-01 10:13:06.991919
pkg:maven/org.webjars.npm/class-validator purl2cpe 2026-06-01 10:13:06.991923
pkg:npm/class-validator purl2cpe 2026-06-01 10:13:06.991927

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2019-18413 vulnerable 2026-06-08 05:13:11.562951 Details available
LOW (3.7)
In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.
Published: 2019-10-24T00:00:00.000Z
Updated: 2024-08-05T01:54:14.412Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.