7.5
High
CVE-2020-7768 The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via…
Description
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| grpc 1.24 | earliest → < 1.24.4 | 1.24.4 |
| @grpc/grpc-js 1.1 | earliest → < 1.1.8 | 1.1.8 |