Mozilla Convict vulnerabilities

3 CVEs affecting Mozilla Convict, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-0163, published 2024-11-26.

More from Mozilla.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-21190, published 2022-05-13. Critical severity, CVSS 9.8. EPSS: 4% chance of exploitation in the next 30 days. This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The…
• CVE-2022-22143, published 2022-05-01. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of…
• CVE-2023-0163, published 2024-11-26. High severity, CVSS 8.4. EPSS: 0.3% chance of exploitation in the next 30 days. Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject attributes that are used in other…