p PatchFirst

CVE-2024-21548

CVE-2024-21548

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. **Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past.

CVSS 7.7 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • bun

    Versions
    • ≥ 0.0.12, < 1.1.30: Affected (semver)

    Update to 1.1.30

  • bun npm

    Affected ranges
    • SEMVER: < 1.1.30

    Update to 1.1.30

Original sources

Check your server →