Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-8bst-w9fp-7faa

Summary

Sandbox Breakout / Prototype Pollution in notevil
Versions of `notevil` are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype.

Evaluating the payload ```try{a[b];}catch(e){e.constructor.constructor('return __proto__.arguments.callee.__proto__.polluted=true')()}``` add the `polluted` property to Function.

Aliases

alias	GHSA-9gxr-rhx6-4jgv

alias	GMS-2020-411

Fixed_packages

url pkg:npm/notevil@1.3.3

purl pkg:npm/notevil@1.3.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-echx-vz3r-ryfq

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@1.3.3

Affected_packages

url pkg:npm/notevil@0.0.0

purl pkg:npm/notevil@0.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.0.0

url pkg:npm/notevil@0.0.1

purl pkg:npm/notevil@0.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.0.1

url pkg:npm/notevil@0.0.2

purl pkg:npm/notevil@0.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.0.2

url pkg:npm/notevil@0.1.0

purl pkg:npm/notevil@0.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.1.0

url pkg:npm/notevil@0.2.0

purl pkg:npm/notevil@0.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.2.0

url pkg:npm/notevil@0.3.0

purl pkg:npm/notevil@0.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.3.0

url pkg:npm/notevil@0.4.0

purl pkg:npm/notevil@0.4.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.4.0

url pkg:npm/notevil@0.5.0

purl pkg:npm/notevil@0.5.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.5.0

url pkg:npm/notevil@0.6.0

purl pkg:npm/notevil@0.6.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.6.0

url pkg:npm/notevil@0.7.0

purl pkg:npm/notevil@0.7.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.7.0

url pkg:npm/notevil@0.8.0

purl pkg:npm/notevil@0.8.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.8.0

url pkg:npm/notevil@0.8.1

purl pkg:npm/notevil@0.8.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@0.8.1

url pkg:npm/notevil@1.0.0

purl pkg:npm/notevil@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@1.0.0

url pkg:npm/notevil@1.1.0

purl pkg:npm/notevil@1.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@1.1.0

url pkg:npm/notevil@1.2.0

purl pkg:npm/notevil@1.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@1.2.0

url pkg:npm/notevil@1.3.0

purl pkg:npm/notevil@1.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@1.3.0

url pkg:npm/notevil@1.3.1

purl pkg:npm/notevil@1.3.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-75c9-8124-buaa

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@1.3.1

url pkg:npm/notevil@1.3.2

purl pkg:npm/notevil@1.3.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-8bst-w9fp-7faa

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/notevil@1.3.2

References

reference_url

https://www.npmjs.com/advisories/1338

reference_id

reference_type

scores

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://www.npmjs.com/advisories/1338

reference_url	https://github.com/advisories/GHSA-9gxr-rhx6-4jgv
reference_id	GHSA-9gxr-rhx6-4jgv
reference_type
scores
url	https://github.com/advisories/GHSA-9gxr-rhx6-4jgv

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1321
name	Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Exploits

Severity_range_score 4.0 - 6.9

Exploitability 0.5

Weighted_severity 6.2

Risk_score 3.1

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8bst-w9fp-7faa

Vulnerability Instance