{"api_version":"1","generated_at":"2026-07-23T09:46:52+00:00","cve":"CVE-2020-7765","urls":{"html":"https://cve.report/CVE-2020-7765","api":"https://cve.report/api/cve/CVE-2020-7765.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-7765","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-7765"},"summary":{"title":"CVE-2020-7765","description":"This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.","state":"PUBLIC","assigner":"report@snyk.io","published_at":"2020-11-16 12:15:00","updated_at":"2020-12-01 17:28:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324","name":"N/A","refsource":"CONFIRM","tags":["Exploit","Third Party Advisory"],"title":"Prototype Pollution in @firebase/util | Snyk","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada","name":"N/A","refsource":"CONFIRM","tags":["Patch","Third Party Advisory"],"title":"Prevent __proto__ pollution in util.deepExtend (#4001) · firebase/firebase-js-sdk@9cf727f · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://github.com/firebase/firebase-js-sdk/pull/4001","name":"N/A","refsource":"CONFIRM","tags":["Patch","Third Party Advisory"],"title":"Prevent __proto__ pollution in util.deepExtend by Feiyang1 · Pull Request #4001 · firebase/firebase-js-sdk · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7765","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7765","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Snyk Security Team","lang":""}],"nvd_cpes":[{"cve_year":"2020","cve_id":"7765","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"firebase\\/util","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"node.js","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"7765","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"firebase\\/util","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"node.js","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-7765","qid":"982580","title":"Nodejs (npm) Security Update for @firebase/util (GHSA-fpm5-vv97-jfwg)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ASSIGNER":"report@snyk.io","DATE_PUBLIC":"2020-11-16T11:59:58.812992Z","ID":"CVE-2020-7765","STATE":"PUBLIC","TITLE":"Prototype Pollution"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"@firebase/util","version":{"version_data":[{"version_affected":"<","version_value":"0.3.4"}]}}]},"vendor_name":"n/a"}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Prototype Pollution"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324","name":"https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324"},{"refsource":"MISC","url":"https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada","name":"https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada"},{"refsource":"MISC","url":"https://github.com/firebase/firebase-js-sdk/pull/4001","name":"https://github.com/firebase/firebase-js-sdk/pull/4001"}]},"description":{"description_data":[{"lang":"eng","value":"This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program."}]},"impact":{"cvss":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},"credit":[{"lang":"eng","value":"Snyk Security Team"}]},"nvd":{"publishedDate":"2020-11-16 12:15:00","lastModifiedDate":"2020-12-01 17:28:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:google:firebase\\/util:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.3.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"7765","Ordinal":"168046","Title":"CVE-2020-7765","CVE":"CVE-2020-7765","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"7765","Ordinal":"1","NoteData":"This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"7765","Ordinal":"2","NoteData":"2020-11-16","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"7765","Ordinal":"3","NoteData":"2020-11-16","Type":"Other","Title":"Modified"}]}}}