Skip to content
Fencer Intel
high 7.3

CVE-2020-7774 in the critical feed json

Prototype Pollution

published 5y ago modified 4mo ago also GHSA-c4w7-xm78-47vh , EUVD-2021-0643

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
69.6%
EPSS 69.6% chance of exploitation in 30 days, percentile 99.3%
public exploits
0
none known

Summary

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Patch / fix

  • npm y18n 3.2.2, 4.0.1, 5.0.5
  • n/a y18n 5.0.5
  • node-y18n Debian 14, Debian 13, Debian 12 4.0.0-3

debian advisories DEBIAN-CVE-2020-7774

  • npm RHEL 8 1:6.14.10-1.14.15.4.2.module+el8.3.0+9635+ffdf8381
  • nodejs RHEL 8 1:14.15.4-2.module+el8.3.0+9635+ffdf8381
  • nodejs-nodemon RHEL 8 2.0.3-1.module+el8.3.0+6519+9f98ed83
  • nodejs-full-i18n RHEL 8 1:14.15.4-2.module+el8.3.0+9635+ffdf8381
  • nodejs-packaging RHEL 8 23-3.module+el8.3.0+6519+9f98ed83
  • rh-nodejs12-nodejs RHEL 3 SOFTWARE_COLLECTIONS 12.19.1-2.el7
  • rh-nodejs12-npm RHEL 3 SOFTWARE_COLLECTIONS 6.14.8-12.19.1.2.el7
  • rh-nodejs14-nodejs RHEL 3 SOFTWARE_COLLECTIONS 14.15.4-2.el7

red hat advisories RHSA-2021:0551RHSA-2020:5305RHSA-2021:0421RHSA-2021:0548RHSA-2021:0521RHSA-2020:5499

  • nodejs8 SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +10 more 8.17.0-3.47.2
  • nodejs-common SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 2.0-3.2.1
  • nodejs8 SLE Module for Web and Scripting 15 SP2 8.17.0-10.12.2
  • nodejs14 SLE Module for Web and Scripting 15 SP3, SLE Module for Web and Scripting 15 SP2 14.17.2-5.12.1
  • nodejs10 SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 10.24.1-1.36.1
  • nodejs12 SLE Module for Web and Scripting 15 SP3, SLE Module for Web and Scripting 15 SP2 12.22.2-4.16.1
  • nodejs12 SLE Module for Web and Scripting 12 12.22.2-1.32.1
  • nodejs10 SLE Module for Web and Scripting 12 10.24.1-1.39.1

suse advisories SUSE-SU-2021:2620-1SUSE-SU-2021:2618-1SUSE-SU-2021:2354-1SUSE-SU-2021:2353-1SUSE-SU-2021:2327-1SUSE-SU-2021:2326-1

  • nodejs14 openSUSE Tumbleweed 14.17.5-1.2
  • nodejs8 openSUSE Leap 15.2 8.17.0-lp152.3.14.1
  • nodejs8 openSUSE Leap 15.3 8.17.0-10.12.2
  • nodejs10 openSUSE Leap 15.2 10.24.1-lp152.2.15.1
  • nodejs14 openSUSE Leap 15.2 14.17.2-lp152.11.1
  • nodejs12 openSUSE Leap 15.2 12.22.2-lp152.3.15.1
  • nodejs14 openSUSE Leap 15.3 14.17.2-5.12.1
  • nodejs10 openSUSE Leap 15.3 10.24.1-1.36.1

opensuse advisories openSUSE-SU-2024:11096-1openSUSE-SU-2021:1113-1openSUSE-SU-2021:2618-1openSUSE-SU-2021:1061-1openSUSE-SU-2021:1060-1openSUSE-SU-2021:1059-1

  • nodejs-nodemon AlmaLinux 8 2.0.3-1.module_el8.4.0+2521+c668cc9f
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.5.0+254+b4526b16
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.4.0+2522+3bd42762
  • nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2023+d2377ea3
  • nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2047+b07ac28e
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2224+b07ac28e
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2521+c668cc9f
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.3.0+2023+d2377ea3

almalinux advisories ALSA-2021:0551ALSA-2021:0548ALSA-2020:5499

  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.6.0+982+9fdca2d4
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.3.0+100+234774f7
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.4.0+638+5344c6f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.5.0+733+de4fee6c
  • nodejs-nodemon Rocky Linux 8 1.18.3-1.module+el8.3.0+101+f84c7154
  • nodejs-packaging Rocky Linux 8 17-3.module+el8.3.0+101+f84c7154

rocky linux advisories RLSA-2021:0551RLSA-2021:0548RLSA-2020:5499

  • nodejs Alpine 3.10 10.24.1-r0
  • nodejs Alpine 3.12, Alpine 3.11 12.22.1-r0
  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 14.16.1-r0

alpine advisories ALPINE-CVE-2020-7774

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2020-7774 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-7774 updated cvss 7.3

nodejs-y18n: prototype pollution vulnerability

  • Red Hat OpenShift Service Mesh 1 kiali, servicemesh-grafana, servicemesh-grafana-prometheus
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-grafana-prometheus Red Hat Advanced Cluster Management for Kubernetes 2 y18n
    affected: no fix available
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-console Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-prometheus-rhel9 Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel8, noobaa-core-container, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat Quay 3 quay
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 10.23.1-1.module+el8.3.0+9502+012d8a97, nodejs 12.19.1-1.module+el8.3.0+8851+b7b41ca0, nodejs 14.15.4-2.module+el8.3.0+9635+ffdf8381, nodejs-packaging 17-3.module+el8+2873+aa7dfd9a, nodejs-nodemon 1.18.3-1.module+el8+2632+6c5111ed, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, +9 more
    fixed: vendor fix RHSA-2021:0548
  • Red Hat OpenShift Container Platform 4.7 openshift4/ose-grafana v4.7.0-202102130115.p0
    fixed: vendor fix RHSA-2020:5633
  • Red Hat OpenShift Container Platform 4.8 openshift4/ose-thanos-rhel8 v4.8.0-202106291913.p0.git.c358e96.assembly.stream
    fixed: vendor fix RHSA-2021:2438
  • Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/mcg-core-rhel8 5.7.0-60.2c1fdb0.5.7
    fixed: vendor fix RHSA-2021:2041
show 2 more
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.19.1-2.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs12-npm 6.14.8-12.19.1.2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs14-npm 6.14.10-14.15.4.2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.19.1-2.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs12-npm 6.14.8-12.19.1.2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs14-npm 6.14.10-14.15.4.2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.19.1-2.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs12-npm 6.14.8-12.19.1.2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs14-npm 6.14.10-14.15.4.2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.19.1-2.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs12-npm 6.14.8-12.19.1.2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs14-npm 6.14.10-14.15.4.2.el7
    fixed: vendor fix RHSA-2021:0521
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat OpenShift Service Mesh 2.0 kiali Red Hat OpenShift Container Platform 4.7 openshift4/ose-cli v4.7.0-202102130115.p0, openshift4/ose-pod v4.7.0-202102130115.p0, openshift4/ose-etcd v4.7.0-202102130115.p0, openshift4/ose-tests v4.7.0-202102181036.p0, openshift4/ose-console v4.7.0-202102130115.p0, openshift4/ose-coredns v4.7.0-202102130115.p0, +129 more Red Hat OpenShift Container Platform 4.8 openshift4/ose-cli v4.8.0-202106291725.p0.git.1077b05.assembly.stream, openshift4/ose-pod v4.8.0-202107161820.p0.git.051ac4f.assembly.stream, openshift4/ose-etcd v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream, openshift4/ose-tests v4.8.0-202107131424.p0.git.0d958c3.assembly.stream, openshift4/ose-console v4.8.0-202107010336.p0.git.188a490.assembly.stream, openshift4/ose-coredns v4.8.0-202106291913.p0.git.642b46e.assembly.stream, +135 more Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/ocs-operator-bundle 4.7.0-11, ocs4/mcg-rhel8-operator 5.7.0-69.85e2026.5.7, ocs4/cephcsi-rhel8 4.7-102.5c44836.release_4.7, ocs4/ocs-rhel8-operator 4.7-174.7f14177.release_4.7, ocs4/ocs-must-gather-rhel8 4.7-174.7f14177.release_4.7, ocs4/rook-ceph-rhel8-operator 4.7-140.49a6fcf.release_4.7 Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-all-in-one-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

69.59% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • snyk.io https://snyk.io/vuln/SNYK-JS-Y18N-1021887 referenced PoC, tagged "exploit" by a source, unverified
  • snyk.io https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/yargs/y18n/issues/96 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm y18n
<3.2.2
>=4.0.0, <4.0.1
>=5.0.0, <5.0.5
3.2.2
4.0.1
5.0.5

Affected products

  • n/a y18n

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
  • CWE-20 Improper Input Validation
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.