CVE-2020-28478 - Prototype Pollution

HIGH

Prototype Pollution

Published Jan 19, 2021

7.5

HIGH

CVSS 3.1

EPSS 1.60%

This affects the package gsap before 3.6.0.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Gsap	unknown	Affected ≥ unspecified, < 3.6.0

Ecosystem	Package	Introduced	Fixed
npm	gsap	0	3.6.0

No remediation recorded yet.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0494		Advisory
https://github.com/advisories/GHSA-6g8v-hpgw-h2v7		Advisory
https://github.com/greensock/GSAP/blob/master/src/gsap-core.js#L150
https://github.com/greensock/GSAP/blob/master/src/gsap-core.js%23L147		x_refsource_MISCBroken Link
https://github.com/greensock/GSAP/releases/tag/3.6.0
https://nvd.nist.gov/vuln/detail/CVE-2020-28478
https://snyk.io/vuln/SNYK-JS-GSAP-1054614		x_refsource_MISCExploitThird Party Advisory
https://www.npmjs.com/package/gsap/v/3.6.0