CVE-2022-22143

PoC —

CVSS 3.1

9.8 critical

EPSS

2%p81

Published

May 1, 2022 (May 1, 2022)

Modified

Jun 17, 2026

Description

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508)

Vendors: mozilla
Products: convict
Weakness: CWE-1321
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.1%)

In the news0 stories

No ingested article mentions this CVE yet.