CVE-2019-20149

HIGH

kind-of 6.0.0-6.0.2 - Exposure of Resource to Wrong Sphere via ctorName Overwrite

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-20149. PoCs published by mrknowledgshare.

Description

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Exploits (1)

References (2)

Core 2
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/jonschlinkert/kind-of/issues/30
Patch, Third Party Advisory x_refsource_misc
https://github.com/jonschlinkert/kind-of/pull/31

Scores

CVSS v3 7.5
EPSS 0.0021
EPSS Percentile 44.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-668
Status published
Products (2)
kind-of_project/kind-of 6.0.2
npm/kind-of 6.0.0 - 6.0.3npm
Published Dec 30, 2019
Tracked Since Feb 18, 2026