CVE-2024-36573: Almela Obx

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.

Affected products

• Almela Obx: before 0.0.4 (fixed in 0.0.4)

Published 2024-06-17. Last modified 2026-06-17.