Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2022-29823

Feathers - Query “__proto__” is converted to real prototype

Description

Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Feather js Feathers-Sequalize

  • 6.x to < 6.3.4affected

References