GHSA-6cj2-92m5-7mvp
Improperly Controlled Modification of Object Prototype Attributes
Impact
The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Patches
think-config@1.1.3 patched it, anyone used think-config should upgrade to >=1.1.3 version.
References
https://cwe.mitre.org/data/definitions/1321.html
For more information
If you have any questions or comments about this advisory:
- Open an issue in thinkjs/thinkjs
- Email us at i@imnerd.org
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score used
Improperly Controlled Modification of Object Prototype Attributes
Impact
The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Patches
think-config@1.1.3 patched it, anyone used think-config should upgrade to >=1.1.3 version.
References
https://cwe.mitre.org/data/definitions/1321.html
For more information
If you have any questions or comments about this advisory:
- Open an issue in thinkjs/thinkjs
- Email us at i@imnerd.org
- Record
GHSA-6cj2-92m5-7mvp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV
Improperly Controlled Modification of Object Prototype Attributes
Impact
The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Patches
think-config@1.1.3 patched it, anyone used think-config should upgrade to >=1.1.3 version.
References
https://cwe.mitre.org/data/definitions/1321.html
For more information
If you have any questions or comments about this advisory:
- Open an issue in thinkjs/thinkjs
- Email us at i@imnerd.org
- Record
GHSA-6cj2-92m5-7mvp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
think-confignpm | before 1.1.3 | 1.1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-6cj2-92m5-7mvp is a high vulnerability (CVSS 7.5) in think-config, published August 3, 2021. No source lists public exploit code. Fixed in think-config 1.1.3.