CVE-2020-7765

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Nov 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-77669.8This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointe CVE-2020-77675.3All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-craft CVE-2020-77689.8The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.CVE-2020-77699.8This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection i CVE-2020-77709.8This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not CVE-2020-77719.8The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.CVE-2020-77729.8This affects the package doc-path before 2.1.2.CVE-2020-77736.1This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown CVE-2020-77749.8The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.CVE-2020-77759.8This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freed CVE-2020-77766.4This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel fi CVE-2020-77777.2This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim