Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/63184?format=api",
    "purl": "pkg:npm/convict@6.2.3",
    "type": "npm",
    "namespace": "",
    "name": "convict",
    "version": "6.2.3",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": false,
    "next_non_vulnerable_version": "6.2.2",
    "latest_non_vulnerable_version": "6.2.3",
    "affected_by_vulnerabilities": [],
    "fixing_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/43961?format=api",
            "vulnerability_id": "VCID-dxn8-er51-b7gu",
            "summary": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')\nThis affects the package convict before 6.2.3. This is a bypass of CVE-2022-22143 introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.__proto__ or foo.this.constructor.prototype.",
            "references": [
                {
                    "reference_url": "https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808"
                },
                {
                    "reference_url": "https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571"
                },
                {
                    "reference_url": "https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07"
                },
                {
                    "reference_url": "https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75"
                },
                {
                    "reference_url": "https://snyk.io/vuln/SNYK-JS-CONVICT-2774757",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://snyk.io/vuln/SNYK-JS-CONVICT-2774757"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21190",
                    "reference_id": "CVE-2022-21190",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21190"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-jjf5-wx3j-3fv7",
                    "reference_id": "GHSA-jjf5-wx3j-3fv7",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-jjf5-wx3j-3fv7"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/63184?format=api",
                    "purl": "pkg:npm/convict@6.2.3",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/convict@6.2.3"
                }
            ],
            "aliases": [
                "CVE-2022-21190",
                "GHSA-jjf5-wx3j-3fv7"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dxn8-er51-b7gu"
        }
    ],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/convict@6.2.3"
}