What is CVE-2024-21548?

CVE-2024-21548 is a high-severity vulnerability in Bun, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 7.5/10. Published 2024-12-18.

How severe is CVE-2024-21548?

High severity. CVSS v3 base score is 7.5 out of 10.

Prototype Pollution in Bun

CVE-2024-21548

Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. **Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past.

Vulnerability class: Prototype Pollution

EPSS: 0.006 (47.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

N/a Bun — versions 0.0.12

Weakness classification (CWE)

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

References

Frequently asked questions

What is CVE-2024-21548?: CVE-2024-21548 is a high-severity vulnerability in Bun, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 7.5/10. Published 2024-12-18.
How severe is CVE-2024-21548?: High severity. CVSS v3 base score is 7.5 out of 10.