CVE-2020-7618

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published
Apr 7, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-76199.8get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments providedCVE-2020-76209.8pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' paramsCVE-2020-76219.8strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmdCVE-2020-76229.8This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means CVE-2020-76239.8jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.CVE-2020-76249.8effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.CVE-2020-76259.8op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.CVE-2020-76269.8karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.CVE-2020-76279.8node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument inCVE-2020-76289.8umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.CVE-2020-76299.8install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.CVE-2020-76309.8git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument.
CVE-2020-7618: Medium severity, CVSS 5.3 | Vulnix