7.5
High
CVE-2022-22143 The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing…
Description
The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508)
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| convict 6.2 | earliest → < 6.2.2 | 6.2.2 |