cve/2020/CVE-2020-7768.md

CVE-2020-7768

Description

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.

POC

Reference

• https://github.com/grpc/grpc-node/pull/1606
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038819
• https://snyk.io/vuln/SNYK-JS-GRPC-598671
• https://snyk.io/vuln/SNYK-JS-GRPCGRPCJS-1038818

Github

• https://github.com/Live-Hack-CVE/CVE-2020-7768