{"id":"CVE-2022-29823","published":"2022-10-25T00:00:00Z","modified":"2025-03-11T13:39:49Z","title":"Feathers - Query “__proto__” is converted to real prototype","vendor":"Feather js","product":"Feathers-Sequalize","tier":"tail","description":{"text":"Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.","provenance":"source","from":"CVE.org"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01834,"percentile":0.78865,"provenance":"source"},"cwes":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"references":[{"url":"https://csirt.divd.nl/DIVD-2022-00020","tags":["third-party-advisory"]},{"url":"https://csirt.divd.nl/CVE-2022-29823/","tags":["third-party-advisory"]}],"priority":{"score":22.8,"factors":[{"name":"EPSS percentile","points":15.77},{"name":"CVSS severity","points":7.0}]},"vendorSlug":"feather-js","affectedVersions":[{"vendor":"Feather js","product":"Feathers-Sequalize","versions":[">= 6.x, < 6.3.4"]}],"affected":[{"ecosystem":"npm","package":"feathers-sequelize","vulnerableRanges":[">=6.0.0, <6.3.3"],"patched":["6.3.3"],"from":["GHSA-p5m3-27vh-52j4"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7140","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-feathers-sequalize-cve-2022-2422","children":[{"from":"CVE-2022-29823","to":"CVE-2022-2422","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:feathers-sequelize","fromFixed":"6.3.3","toFixed":"6.3.4","daysApart":0},{"kind":"same-code","provenance":"machine","files":["lib/index.js"],"commits":["https://github.com/feathersjs-ecosystem/feathers-sequelize/commit/0f2d85f0b2d556f2b6c70423dcebdbd29d95e3dc","https://github.com/feathersjs-ecosystem/feathers-sequelize/commit/0b7beaa773dc313fdb27edd9ee8115064d7cf114"],"basis":"shared function","functions":["Service"]}]},{"from":"CVE-2022-29823","to":"CVE-2022-29822","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:feathers-sequelize","fromFixed":"6.3.3","toFixed":"6.3.4","daysApart":0},{"kind":"same-code","provenance":"machine","files":["lib/index.js"],"commits":["https://github.com/feathersjs-ecosystem/feathers-sequelize/commit/0f2d85f0b2d556f2b6c70423dcebdbd29d95e3dc","https://github.com/feathersjs-ecosystem/feathers-sequelize/commit/0b7beaa773dc313fdb27edd9ee8115064d7cf114"],"basis":"shared function","functions":["Service"]}]}],"packageHistory":[{"cve":"CVE-2022-29823","published":"2022-10-25","fixed":"6.3.3","kev":false},{"cve":"CVE-2022-2422","published":"2022-10-25","fixed":"6.3.4","kev":false},{"cve":"CVE-2022-29822","published":"2022-10-25","fixed":"6.3.4","kev":false}],"package":"npm:feathers-sequelize"}}