CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2022-25862
High (7.5) in sds project sds. EPSS 0.7% chance of exploitation in the next 30 days.
This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-7618](https://security.snyk.io/vuln/SNYK-JS-SDS-564123)
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sds_project:sds
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ph28-wwfj-fv7f | npm | sds | <=4.4.0 | no fix published |