Fluid Attacks Database

Description

Prototype pollution in grpc and @grpc/grpc-js "The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	@grpc/grpc-js	>=0 <1.1.8	1.1.8
npm	grpc	>=0 <1.24.4	1.24.4

Aliases

1. CVE-2020-77682. NVD-2020-77683. OSV-2020-77684. GCVE-2020-7768

References

1. https://github.com/grpc/grpc-node/pull/16052. https://github.com/grpc/grpc-node/pull/16063. https://github.com/grpc/grpc-node/releases/tag/grpc%401.24.44. https://www.npmjs.com/package/@grpc/grpc-js5. https://www.npmjs.com/package/grpc

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.