Putil Merge Project

putil-merge_project

2 CVEs • 1 product

Products (1)

Click to collapse

Toggle

Putil Merge

putil-merge

2 CVEs

CVEs (2)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-23470 1Putil Merge Project 1Putil Merge Jun 17, 2026 Feb 4, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor prope...Show more This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077Show less
CVE-2021-25953 1Putil Merge Project 1Putil Merge Jun 17, 2026 Jul 14, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2021-23470

1Putil Merge Project

1Putil Merge

Jun 17, 2026

Feb 4, 2022

N/A· v4

9.8 CRITICAL· v3

7.5 HIGH· v2

This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077Show less

CVE-2021-25953