Skip to content
Fencer Intel
critical 9.8

CVE-2022-37598 json

Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js.

published 4y ago modified 4mo ago also EUVD-2022-40223

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.

Is CVE-2022-37598 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-37598 updated cvss 9.8

uglify-js: Prototype pollution vulnerability in function DEFNODE in ast.js

  • Red Hat Migration Toolkit for Runtimes uglify-js
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8 Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus, openshift-service-mesh/kiali-rhel8 Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, openshift-service-mesh/kiali-rhel8 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator Red Hat Ceph Storage 4 cockpit-ceph-installer
    affected: no fix planned “Will not fix”
  • Red Hat Decision Manager 7 uglify-js
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7 uglify-js Red Hat Integration Camel K 1 uglify-js
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Data Grid 7 uglify-js Red Hat OpenShift Container Platform 3.11 openshift3/ose-console Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-query-rhel8, rhosdt/jaeger-all-in-one-rhel8
    affected: no fix available
  • Red Hat Process Automation 7 uglify-js
    affected: no fix planned “Out of support scope”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: no fix available
show 1 more
  • Red Hat A-MQ Online uglify-js Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, rhacm2/application-ui-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8 Red Hat Ansible Automation Platform 2 aap-azure-ui Red Hat build of Apicurio Registry 2 uglify-js Red Hat Discovery 1 discovery-server-container
    +8 more products
    Red Hat Enterprise Linux 6 firefox Red Hat Enterprise Linux 7 firefox Red Hat Enterprise Linux 8 pcs, cockpit, grafana, mozjs60, pcs-snmp, cockpit-ws, +27 more Red Hat Enterprise Linux 9 gjs, polkit, grafana, polkit-libs, grafana-selinux Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel8, noobaa-core-container Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel8, devspaces-theia-rhel8-container Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
2y ago

Exploit prediction

1.99% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L46 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L79 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.