{"id":"CVE-2019-20149","aliases":["AZL-44298","AZL-47271","DEBIAN-CVE-2019-20149","EUVD-2020-0335","GHSA-6c8f-qphg-qjgp","UBUNTU-CVE-2019-20149"],"status":"published","title":"Validation Bypass in kind-of","description":"ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02342,"percentile":0.83748,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-668"],"published":"2019-12-30T18:25:10Z","modified":"2026-11-05T05:36:30Z","exploits":[{"source":"pocgithub","id":"mrknowledgshare/testing_cve-2019-20149","title":"mrknowledgshare/testing_cve-2019-20149","date":"2026-02-27","url":"https://github.com/mrknowledgshare/testing_cve-2019-20149"}],"fixes":[{"ecosystem":"npm","package":"kind-of","fixed_in":["6.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"js-jquery","fixed_in":["3.5.0-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"js-jquery","fixed_in":["3.5.0-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-kind-of","fixed_in":["6.0.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-kind-of","fixed_in":["6.0.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-kind-of","fixed_in":["6.0.3+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"kind-of","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"node-kind-of","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-kind-of","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-kind-of","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"kind-of","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-kind-of","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4+dfsg-1","6.0.1+dfsg-1","6.0.2+dfsg-1"]}],"products":[{"vendor":"kind-of_project","product":"kind-of"}],"references":[{"url":"https://github.com/jonschlinkert/kind-of/issues/30","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/jonschlinkert/kind-of/pull/31","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20149","tags":["web","advisory"]},{"url":"https://github.com/jonschlinkert/kind-of/commit/1df992ce6d5a1292048e5fe9c52c5382f941ee0b","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-KINDOF-537849","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1490","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6c8f-qphg-qjgp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-20149","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20149","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-20149","description":"ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","status":"published","published":"2019-12-30T18:25:10Z","modified":"2024-08-05T02:39:08.099Z","updated_at":"2026-11-02T14:20:17.431882Z"}],"euvd":[{"id":"EUVD-2020-0335","description":"ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","status":"published","published":"2019-12-30T18:25:10Z","modified":"2024-08-05T02:39:08Z","updated_at":"2026-11-03T02:40:22.702411Z"}],"ghsa":[{"id":"GHSA-6c8f-qphg-qjgp","title":"Validation Bypass in kind-of","description":"Versions of `kind-of` 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. \n\n\n## Recommendation\n\nUpgrade to versions 6.0.3 or later.","status":"published","published":"2020-03-31T15:59:54Z","modified":"2023-11-29T20:47:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2019-20149","description":"ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","status":"published","published":"2019-12-30T19:15:11.91Z","modified":"2026-06-17T02:30:00.723Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:05:41.313583Z"}],"osv":[{"id":"AZL-44298","title":"CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4","description":"ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","status":"published","published":"2019-12-30T19:15:11Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"AZL-47271","title":"CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4","description":"ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","status":"published","published":"2019-12-30T19:15:11Z","modified":"2026-04-21T04:32:51.781581Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"CVE-2019-20149","description":"ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","status":"published","published":"2019-12-30T19:15:11.91Z","modified":"2026-10-20T10:52:39.153201183Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-20149","description":"ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","status":"published","published":"2019-12-30T19:15:11.91Z","modified":"2026-09-21T07:02:36.51259543Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"GHSA-6c8f-qphg-qjgp","title":"Validation Bypass in kind-of","description":"Versions of `kind-of` 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. \n\n\n## Recommendation\n\nUpgrade to versions 6.0.3 or later.","status":"published","published":"2020-03-31T15:59:54Z","modified":"2023-11-08T04:01:30.082511Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"UBUNTU-CVE-2019-20149","description":"ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","status":"published","published":"2019-12-30T19:15:00Z","modified":"2025-10-24T04:48:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"}]}}