CVE-2023-38894

CriticalCVSS 9.8

Published: 16/08/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.41%

69th percentile - higher than 69% of all known CVEs

Summary

A Prototype Pollution vulnerability was found in Tree-kit library version 0.7.4 and earlier. It allows a remote attacker to execute arbitrary code via the extend function.

Risk Assessment

An attacker can remotely take control of the application using the vulnerable library, leading to compromise of data confidentiality, integrity, and availability.

Recommendation

Immediately update the Tree-kit library to a version later than 0.7.4 where the vulnerability is patched.

Original NVD description (English source)

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.