Immer Project

immer_project

3 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-3757 1Immer Project 1Immer Jun 17, 2026 Sep 2, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVE-2021-23436 1Immer Project 1Immer Jun 17, 2026 Sep 1, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible...Show more This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" \|\| p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.Show less
CVE-2020-28477 1Immer Project 1Immer Jun 17, 2026 Jan 19, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 This affects all versions of package immer.