{"id":"CVE-2022-37598","aliases":["AZL-44541","DEBIAN-CVE-2022-37598","EUVD-2022-40223","GHSA-wx5g-37jh-9gcr"],"status":"disputed","title":"Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the...","description":"Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01989,"percentile":0.80776,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1321"],"published":"2022-10-20T00:00:00Z","modified":"2026-11-05T05:36:30Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"uglify-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.17.4-2","3.17.4-3","3.19.3-1","3.19.3-2"]},{"source":"osv","ecosystem":"Debian:13","package":"uglify-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.17.4-2","3.17.4-3","3.19.3-1","3.19.3-2"]},{"source":"osv","ecosystem":"Debian:14","package":"uglify-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.17.4-2","3.17.4-3","3.19.3-1","3.19.3-2"]},{"source":"osv","ecosystem":"Debian:13","package":"uglifyjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.29-8","2.8.29-8+deb13u1","2.8.29-9","3.3.10-1"]}],"products":[{"vendor":"uglifyjs_project","product":"uglifyjs"}],"references":[{"url":"https://github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L46","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L79","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/mishoo/UglifyJS/issues/5699","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/mishoo/UglifyJS/issues/5721#issuecomment-1292849604","tags":["x_transferred","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37598","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wx5g-37jh-9gcr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37598.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-37598","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-37598","description":"Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.","status":"disputed","published":"2022-10-20T00:00:00Z","modified":"2024-08-03T10:29:21.029Z","updated_at":"2026-11-02T14:34:26.977054Z"}],"euvd":[{"id":"EUVD-2022-40223","description":"Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.","status":"published","published":"2022-10-20T00:00:00Z","modified":"2024-08-03T10:29:21Z","updated_at":"2026-11-03T03:25:23.480504Z"}],"ghsa":[{"id":"GHSA-wx5g-37jh-9gcr","title":"Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the...","description":"Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js.","status":"published","published":"2022-10-20T12:00:15Z","modified":"2023-01-28T05:06:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:44:29.269512Z"}],"nvd":[{"id":"CVE-2022-37598","description":"Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.","status":"disputed","published":"2022-10-20T11:15:10.437Z","modified":"2026-06-17T04:55:08.18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:07:30.6869Z"}],"osv":[{"id":"AZL-44541","title":"CVE-2022-37598 affecting package js-jquery 3.5.0-4","description":"Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.","status":"published","published":"2022-10-20T11:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"DEBIAN-CVE-2022-37598","description":"Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.","status":"published","published":"2022-10-20T11:15:10.437Z","modified":"2026-11-03T08:03:55.314525957Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:23:34.488036Z"},{"id":"CVE-2022-37598","description":"Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.","status":"published","published":"2022-10-20T00:00:00Z","modified":"2026-10-28T02:30:29.728540168Z","updated_at":"2026-11-02T15:44:26.53798Z"}]}}