Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/tree-kit@0.7.0
Typenpm
Namespace
Nametree-kit
Version0.7.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.7.5
Latest_non_vulnerable_version0.7.5
Affected_by_vulnerabilities
0
url VCID-vfd6-xphy-tkab
vulnerability_id VCID-vfd6-xphy-tkab
summary 
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-38894
reference_id
reference_type
scores
0
value 0.02678
scoring_system epss
scoring_elements 0.8614
published_at 2026-06-06T12:55:00Z
1
value 0.02678
scoring_system epss
scoring_elements 0.86138
published_at 2026-06-09T12:55:00Z
2
value 0.02678
scoring_system epss
scoring_elements 0.86137
published_at 2026-06-05T12:55:00Z
3
value 0.02678
scoring_system epss
scoring_elements 0.86136
published_at 2026-06-07T12:55:00Z
4
value 0.02678
scoring_system epss
scoring_elements 0.86125
published_at 2026-06-08T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-38894
1
reference_url https://github.com/cronvel/tree-kit
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-10-08T19:24:37Z/
url https://github.com/cronvel/tree-kit
2
reference_url https://github.com/cronvel/tree-kit/commit/61bf10cf0dbddaeea3f198cfe7cb469f360d82bc
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/cronvel/tree-kit/commit/61bf10cf0dbddaeea3f198cfe7cb469f360d82bc
3
reference_url https://www.code-intelligence.com/blog/treekit-prototype-pollution-cve-2023-38894
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-10-08T19:24:37Z/
url https://www.code-intelligence.com/blog/treekit-prototype-pollution-cve-2023-38894
4
reference_url http://tree-kit.com
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-10-08T19:24:37Z/
url http://tree-kit.com
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-38894
reference_id CVE-2023-38894
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-38894
6
reference_url https://github.com/advisories/GHSA-5p42-m6f3-hpmj
reference_id GHSA-5p42-m6f3-hpmj
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-5p42-m6f3-hpmj
fixed_packages
0
url pkg:npm/tree-kit@0.7.5
purl pkg:npm/tree-kit@0.7.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/tree-kit@0.7.5
aliases CVE-2023-38894, GHSA-5p42-m6f3-hpmj
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vfd6-xphy-tkab
Fixing_vulnerabilities
0
url VCID-fx9n-549u-qkh7
vulnerability_id VCID-fx9n-549u-qkh7
summary 
tree-kit vulnerable to Prototype Pollution
A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to address this issue. The name of the patch is a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. It is recommended to upgrade the affected component. The identifier VDB-216765 was assigned to this vulnerability.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-4278
reference_id
reference_type
scores
0
value 0.00099
scoring_system epss
scoring_elements 0.27264
published_at 2026-06-05T12:55:00Z
1
value 0.00099
scoring_system epss
scoring_elements 0.27131
published_at 2026-06-09T12:55:00Z
2
value 0.00099
scoring_system epss
scoring_elements 0.27123
published_at 2026-06-08T12:55:00Z
3
value 0.00099
scoring_system epss
scoring_elements 0.27171
published_at 2026-06-07T12:55:00Z
4
value 0.00099
scoring_system epss
scoring_elements 0.27211
published_at 2026-06-06T12:55:00Z
5
value 0.00099
scoring_system epss
scoring_elements 0.27194
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-4278
1
reference_url https://github.com/cronvel/tree-kit
reference_id
reference_type
scores
0
value 7.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cronvel/tree-kit
2
reference_url https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd
reference_id
reference_type
scores
0
value 7.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd
3
reference_url https://github.com/cronvel/tree-kit/releases/tag/v0.7.0
reference_id
reference_type
scores
0
value 7.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cronvel/tree-kit/releases/tag/v0.7.0
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-4278
reference_id
reference_type
scores
0
value 7.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-4278
5
reference_url https://vuldb.com/?ctiid.216765
reference_id
reference_type
scores
0
value 7.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://vuldb.com/?ctiid.216765
6
reference_url https://vuldb.com/?id.216765
reference_id
reference_type
scores
0
value 7.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://vuldb.com/?id.216765
7
reference_url https://github.com/advisories/GHSA-mw4x-g2x8-qcvf
reference_id GHSA-mw4x-g2x8-qcvf
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mw4x-g2x8-qcvf
fixed_packages
0
url pkg:npm/tree-kit@0.7.0
purl pkg:npm/tree-kit@0.7.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-vfd6-xphy-tkab
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/tree-kit@0.7.0
aliases CVE-2021-4278, GHSA-mw4x-g2x8-qcvf
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fx9n-549u-qkh7
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/tree-kit@0.7.0