CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2019-20149
High (7.5) in kind-of project kind-of. EPSS 2.3% chance of exploitation in the next 30 days. Fixed in kind-of 6.0.3.
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Severity
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-668
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kind-of_project:kind-of
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6c8f-qphg-qjgp | npm | kind-of | >=6.0.0 <6.0.3 | 6.0.3 |