LiveActive security incident?Get immediate response
CVE Record

CVE-2020-7708: Prototype Pollution

The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2020-7708 affects the JavaScript packages irrelon-path and @irrelon/path before 4.7.0. A flaw called prototype pollution can let attacker-controlled input alter shared object behavior inside an application. Business impact depends on whether vulnerable functions receive untrusted input, but the published CVSS score is critical.

Executive priority

Treat this as high priority for JavaScript applications with the affected packages. The urgency is greatest where external input is processed into object paths, because impacts could include data exposure, tampering, or service disruption.

Technical view

The vulnerable packages allow prototype pollution through set, unSet, pushVal, and pullVal before version 4.7.0. If untrusted path data reaches these functions, JavaScript object prototypes may be modified, potentially affecting confidentiality, integrity, or availability. The bundle does not identify affected applications beyond these packages.

Likely exposure

Exposure is most likely in Node.js or browser JavaScript applications using irrelon-path or @irrelon/path directly or transitively, especially where user-controlled path or value data reaches the named functions.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation. The CVSS vector includes proof-of-concept exploit maturity, but no cited source here confirms real-world attacks.

Researcher notes

Focus on reachability and input control. Package presence alone does not prove exploitable exposure, but vulnerable versions plus untrusted path input are the key risk indicators. The bundle names no workaround beyond fixed versions and vendor guidance.

Mitigation direction

  • Upgrade irrelon-path and @irrelon/path to 4.7.0 or later where used.
  • Check vendor and package advisories before deploying dependency changes.
  • Remove unused direct dependencies on the affected packages.
  • Review application handling of untrusted object path input.
  • Prioritize internet-facing services and authentication or authorization code paths.

Validation and detection

  • Inventory direct and transitive dependencies for both affected package names.
  • Confirm installed versions are not earlier than 4.7.0.
  • Review code paths using set, unSet, pushVal, or pullVal.
  • Assess whether untrusted input can reach those functions.
  • Run regression tests after dependency updates.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-7708 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2020-7708Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/airrelon-pathunspecifiedListed
n/a@irrelon/pathunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.