CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-23760
Critical (9.8) in keyget project keyget. EPSS 1.7% chance of exploitation in the next 30 days.
The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-28272](https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048)
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- keyget_project:keyget
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9fp7-4fjm-q3mf | npm | keyget | <=2.4.0 | no fix published |