CVE-2022-37257

CriticalCVSS 9.8

Published: 15/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.06%

60th percentile - higher than 60% of all known CVEs

Summary

A prototype pollution vulnerability was discovered in stealjs library version 2.2.4 in the convertLater function in npm-convert.js. The issue is caused by the requestedVersion variable that can be manipulated by an attacker.

Risk Assessment

An attacker can exploit this vulnerability to modify the prototype of JavaScript objects, potentially leading to arbitrary code execution or privilege escalation in applications using the vulnerable library.

Recommendation

Immediately update the stealjs library to the latest available version that includes a fix for this vulnerability. If an update is not possible, restrict trust in input data passed to the convertLater function.

Original NVD description (English source)

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.