Prototype Pollution
Published Jan 19, 2021
7.5
HIGHCVSS 3.1
EPSS 2.29%
Description
This affects all versions of package immer.
Affected products
- Vendor n/a Product Immer Defaultn/a
- Version 0StatusaffectedConstraints<unspecified
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Immer | n/a |
|
- < 8.0.1
No data.
Red Hat Virtualization Engine 4.4
ovirt-web-ui-0:1.6.7-1.el8ev
Fixed · RHSA-2021:1169
OpenShift Service Mesh 1
kiali
Not affected
OpenShift Service Mesh 1
servicemesh-grafana
Not affected
OpenShift Service Mesh 1
servicemesh-prometheus
Not affected
OpenShift Service Mesh 2.0
kiali
Not affected
OpenShift Service Mesh 2.0
servicemesh-grafana
Not affected
OpenShift Service Mesh 2.0
servicemesh-prometheus
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
configmap-watcher
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
endpoint-component-operator
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
management-ingress
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/acmesolver-rhel8
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/grc-ui-api-rhel8
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/kui-web-terminal-rhel8
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/mcm-topology-api-rhel8
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/metrics-collector-rhel9
Not affected
Red Hat OpenShift Container Platform 3.11
openshift3/grafana
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-grafana
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-prometheus-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-thanos-rhel8
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Virtualization Engine 4.4 | ovirt-web-ui-0:1.6.7-1.el8ev | Fixed | RHSA-2021:1169 |
| OpenShift Service Mesh 1 | kiali | Not affected | n/a |
| OpenShift Service Mesh 1 | servicemesh-grafana | Not affected | n/a |
| OpenShift Service Mesh 1 | servicemesh-prometheus | Not affected | n/a |
| OpenShift Service Mesh 2.0 | kiali | Not affected | n/a |
| OpenShift Service Mesh 2.0 | servicemesh-grafana | Not affected | n/a |
| OpenShift Service Mesh 2.0 | servicemesh-prometheus | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | configmap-watcher | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | endpoint-component-operator | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | management-ingress | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acmesolver-rhel8 | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/grc-ui-api-rhel8 | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/kui-web-terminal-rhel8 | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/mcm-topology-api-rhel8 | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/metrics-collector-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift3/grafana | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-grafana | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-prometheus-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-thanos-rhel8 | Not affected | n/a |
immer
npm
Introduced 7.0.0 Fixed 8.0.1
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | immer | 7.0.0 | 8.0.1 |
Remediation
Red Hat statement
Red Hat Virtualization includes affected version of nodejs-immer, however the usage does not meet the conditions required to exploit the flaw, therefore the impact is Low. In OpenShift Container Platform 4.6 (OCP) the openshift4/ose-prometheus container ships the vulnerable version of the nodejs-immer, however the Prometheus react-ui is disabled, hence this flaw cannot be exploited. As openshift4/ose-prometheus container still packages the vulnerable code, this component is affected with impact Low. This may be fixed in a future release.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1 other source (CVE.org) ▾
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:N/C:N/I:N/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (16 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 2.29% (0.02293) | 82.65th | v5 (v2026.06.15) |
| Jun 15, 2026 | 2.29% (0.02293) | 80.93th | v5 (v2026.06.15) |
| Mar 30, 2025 | 0.68% (0.00676) | 69.12th | v4 (v2025.03.14) |
| Mar 29, 2025 | 2.80% (0.02800) | 76.84th | v4 (v2025.03.14) |
| Jul 20, 2024 | 0.17% (0.00171) | 54.56th | v3 (v2023.03.01) |
| Aug 26, 2023 | 0.17% (0.00171) | 53.60th | v3 (v2023.03.01) |
| Apr 13, 2023 | 0.15% (0.00147) | 49.28th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.12% (0.00123) | 44.89th | v3 (v2023.03.01) |
| Mar 6, 2023 | 0.95% (0.00954) | 36.37th | v2 (v2022.01.01) |
| Sep 2, 2022 | 0.95% (0.00954) | 34.50th | v2 (v2022.01.01) |
| Apr 1, 2022 | 0.95% (0.00954) | 32.50th | v2 (v2022.01.01) |
| Feb 4, 2022 | 5.74% (0.05736) | 77.22th | v2 (v2022.01.01) |
| Feb 3, 2022 | 3.63% (0.03630) | 71.73th | v1 |
| Jan 6, 2022 | 3.63% (0.03630) | 71.48th | v1 |
| Sep 1, 2021 | 0.83% (0.00833) | 57.50th | v1 |
| Apr 14, 2021 | 0.83% (0.00833) | 0.00th | v1 |
References (11)
- https://access.redhat.com/security/cve/CVE-2020-28477 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1918162 Issue Tracking
- https://github.com/advisories/GHSA-9qmh-276g-x5pj Advisory
- https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213 x_refsource_MISCBroken Link
- https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5
- https://github.com/immerjs/immer/issues/738
- https://nvd.nist.gov/vuln/detail/CVE-2020-28477
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986 x_refsource_MISCExploitThird Party Advisory
- https://snyk.io/vuln/SNYK-JS-IMMER-1019369 x_refsource_MISCExploitThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-28477
- https://www.npmjs.com/package/immer
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-28477 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1918162 | Issue Tracking | |
| https://github.com/advisories/GHSA-9qmh-276g-x5pj | Advisory | |
| https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213 | x_refsource_MISCBroken Link | |
| https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5 | ||
| https://github.com/immerjs/immer/issues/738 | ||
| https://nvd.nist.gov/vuln/detail/CVE-2020-28477 | ||
| https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986 | x_refsource_MISCExploitThird Party Advisory | |
| https://snyk.io/vuln/SNYK-JS-IMMER-1019369 | x_refsource_MISCExploitThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2020-28477 | ||
| https://www.npmjs.com/package/immer |
Change history (0)
No recorded changes yet.