CVE-2020-7637: Class-Transformer Project Class-Transformer

Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days.

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

Affected products

• Class-Transformer Project Class-Transformer: before 0.3.1 (fixed in 0.3.1)

Published 2020-04-06. Last modified 2026-06-17.