GHSA-593m-55hh-j8gv
Sentry SDK Prototype Pollution gadget in JavaScript SDKs
Impact
In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.
[!NOTE] This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.
Patches
The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version. Also, the fix was backported to SDK v7 in 7.119.1.
References
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
What each source reports
GitHub Advisories Score used
Sentry SDK Prototype Pollution gadget in JavaScript SDKs
Impact
In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.
[!NOTE] This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.
Patches
The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version. Also, the fix was backported to SDK v7 in 7.119.1.
References
- Record
GHSA-593m-55hh-j8gv- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-913
- Updated
- 2026-11-02
OSV
Sentry SDK Prototype Pollution gadget in JavaScript SDKs
Impact
In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.
[!NOTE] This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.
Patches
The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version. Also, the fix was backported to SDK v7 in 7.119.1.
References
- Record
GHSA-593m-55hh-j8gv- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-913
- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-593m-55hh-j8gvNo score
GHSA-593m-55hh-j8gv in @rootio/sentry__browser - Patched by Root
Root has patched GHSA-593m-55hh-j8gv in the @rootio/sentry__browser package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-593m-55hh-j8gv- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@sentry/browsernpm | 8.0.0-alpha.1 up to 8.33.0 | 8.33.0 |
@sentry/browsernpm | before 7.119.1 | 7.119.1 |
@rootio/sentry__browserRoot:npm | before 5.30.0-root.io.1 | 5.30.0-root.io.1 |
@sentry/browserRoot:npm | before 5.30.0-aikido.1 | 5.30.0-aikido.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-593m-55hh-j8gv is a medium vulnerability (CVSS 6.3) in @sentry/browser, published October 3, 2024. No source lists public exploit code. Fixed in @sentry/browser 8.33.0.
References
github.com/getsentry/sentry-javascript/security/advisories/GHSA-593m-55hh-j8gv