CVE-2020-7765

Published: Nov 16, 2020Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

Affected (1)

Products: Google: Firebase/util

Google

1 product

Firebase/util

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Firebase/util	version < 0.3.4

References (6)

https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/firebase/firebase-js-sdk/pull/4001

Source: report@snyk.io

PatchThird Party Advisory

https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324

Source: report@snyk.io

ExploitThird Party Advisory

https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/firebase/firebase-js-sdk/pull/4001

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.