Convict vulnerabilities
We track 2 vulnerabilities in Convict products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on May 13, 2022.
2vulnerabilities
2critical
0high
0exploited
9.8average CVSS score
Latest Convict vulnerabilities
- 9.8 Critical severity
convict: Improperly Controlled Modification of Object Prototype Attributes
This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies on
- 9.8 Critical severity
convict: Improperly Controlled Modification of Object Prototype Attributes
The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS