CVE-2022-37264

CRITICAL

stealjs steal 2.2.4 - Prototype Pollution via optionName Variable

Title source: llm

Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.

Core 3

Core References

Third Party Advisory x_refsource_misc

Third Party Advisory x_refsource_misc

Issue Tracking, Third Party Advisory x_refsource_misc

CVSS v3 9.8

EPSS 0.0114

EPSS Percentile 62.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-1321

Status published

Products (2)

npm/steal 0npm

stealjs/steal 2.2.4

Published Sep 15, 2022

Tracked Since Feb 18, 2026