{"id":"GHSA-hcj4-xf6x-63wj","summary":"Grunt-karma vulnerable to prototype pollution","details":"Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the `key` variable in `grunt-karma.js`.","aliases":["CVE-2022-37602"],"modified":"2023-11-01T04:59:39.935487Z","published":"2022-10-14T12:00:16Z","database_specific":{"nvd_published_at":"2022-10-14T11:15:00Z","cwe_ids":["CWE-1321"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2023-10-19T18:30:53Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37602"},{"type":"WEB","url":"https://github.com/karma-runner/grunt-karma/issues/311"},{"type":"PACKAGE","url":"https://github.com/karma-runner/grunt-karma"},{"type":"WEB","url":"https://github.com/karma-runner/grunt-karma/blob/45b925964f55870f375c6e670d9945b223c984f5/tasks/grunt-karma.js#L109"},{"type":"WEB","url":"https://github.com/karma-runner/grunt-karma/blob/45b925964f55870f375c6e670d9945b223c984f5/tasks/grunt-karma.js#L26"}],"affected":[{"package":{"name":"grunt-karma","ecosystem":"npm","purl":"pkg:npm/grunt-karma"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-hcj4-xf6x-63wj/GHSA-hcj4-xf6x-63wj.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}