GHSA-6c8f-qphg-qjgp
Validation Bypass in kind-of
At a glance
- Published
- Updated
- CVE
- CVE-2019-20149
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
Versions of `kind-of` 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. ## Recommendation Upgrade to versions 6.0.3 or later.
Affected packages
| Package | Versions |
|---|---|
| npm · kind-of | introduced 6.0.0, fixed 6.0.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-20149 ADVISORY
- https://github.com/jonschlinkert/kind-of/issues/30 WEB
- https://github.com/jonschlinkert/kind-of/pull/31 WEB
- https://github.com/jonschlinkert/kind-of/commit/1df992ce6d5a1292048e5fe9c52c5382f941ee0b WEB
- https://snyk.io/vuln/SNYK-JS-KINDOF-537849 WEB
- https://www.npmjs.com/advisories/1490 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |