{"api_version":"1","generated_at":"2026-07-24T20:50:10+00:00","cve":"CVE-2020-7748","urls":{"html":"https://cve.report/CVE-2020-7748","api":"https://cve.report/api/cve/CVE-2020-7748.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-7748","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-7748"},"summary":{"title":"CVE-2020-7748","description":"This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.","state":"PUBLIC","assigner":"report@snyk.io","published_at":"2020-10-20 11:15:00","updated_at":"2022-12-02 19:45:00"},"problem_types":["CWE-1321"],"metrics":[],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-TSEDCORE-1019382","name":"https://snyk.io/vuln/SNYK-JS-TSEDCORE-1019382","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"],"title":"Prototype Pollution in @tsed/core | Snyk","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/TypedProject/tsed/commit/1395773ddac35926cf058fc6da9fb8e82266761b","name":"https://github.com/TypedProject/tsed/commit/1395773ddac35926cf058fc6da9fb8e82266761b","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"fix: Use objectKeys to prevent prototype pollution · TypedProject/tsed@1395773 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/TypedProject/tsed/blob/production/packages/core/src/utils/deepExtends.ts%23L36","name":"https://github.com/TypedProject/tsed/blob/production/packages/core/src/utils/deepExtends.ts%23L36","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":""},{"url":"https://github.com/TypedProject/tsed/blob/production/packages/core/src/utils/deepExtends.ts#L36","name":"MISC:https://github.com/TypedProject/tsed/blob/production/packages/core/src/utils/deepExtends.ts%23L36","refsource":"MITRE","tags":[],"title":"Page not found · GitHub · GitHub","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7748","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7748","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Snyk Security Team","lang":""}],"nvd_cpes":[{"cve_year":"2020","cve_id":"7748","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ts.ed_project","cpe5":"ts.ed","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"node.js","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"7748","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ts.ed_project","cpe5":"ts.ed","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"node.js","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-7748","qid":"981835","title":"Nodejs (npm) Security Update for @tsed/core (GHSA-77xq-cpvg-7xm2)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ASSIGNER":"report@snyk.io","DATE_PUBLIC":"2020-10-20T10:20:56.823750Z","ID":"CVE-2020-7748","STATE":"PUBLIC","TITLE":"Prototype Pollution"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"@tsed/core","version":{"version_data":[{"version_affected":"<","version_value":"5.65.7"}]}}]},"vendor_name":"n/a"}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Prototype Pollution"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://snyk.io/vuln/SNYK-JS-TSEDCORE-1019382","name":"https://snyk.io/vuln/SNYK-JS-TSEDCORE-1019382"},{"refsource":"MISC","url":"https://github.com/TypedProject/tsed/blob/production/packages/core/src/utils/deepExtends.ts%23L36","name":"https://github.com/TypedProject/tsed/blob/production/packages/core/src/utils/deepExtends.ts%23L36"},{"refsource":"MISC","url":"https://github.com/TypedProject/tsed/commit/1395773ddac35926cf058fc6da9fb8e82266761b","name":"https://github.com/TypedProject/tsed/commit/1395773ddac35926cf058fc6da9fb8e82266761b"}]},"description":{"description_data":[{"lang":"eng","value":"This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program."}]},"impact":{"cvss":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},"credit":[{"lang":"eng","value":"Snyk Security Team"}]},"nvd":{"publishedDate":"2020-10-20 11:15:00","lastModifiedDate":"2022-12-02 19:45:00","problem_types":["CWE-1321"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ts.ed_project:ts.ed:*:*:*:*:*:node.js:*:*","versionEndExcluding":"5.65.7","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"7748","Ordinal":"168029","Title":"CVE-2020-7748","CVE":"CVE-2020-7748","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"7748","Ordinal":"1","NoteData":"This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"7748","Ordinal":"2","NoteData":"2020-10-20","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"7748","Ordinal":"3","NoteData":"2020-10-20","Type":"Other","Title":"Modified"}]}}}