LiveActive security incident?Get immediate response
CVE Record

CVE-2024-21548: Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to imp...

Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. **Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past.

HighCVSS 7.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Affected Bun runtime versions may let a user with limited access corrupt shared JavaScript object behavior by supplying a malicious object. This could compromise confidentiality, integrity, or availability in applications that pass attacker-controlled objects into vulnerable Bun APIs.

Executive priority

Treat as a high-priority upgrade for exposed Bun services. Accelerate remediation where attacker-controlled objects reach Bun APIs; otherwise schedule prompt patching after confirming actual runtime versions and input paths.

Technical view

CVE-2024-21548 is a CWE-1321 prototype-pollution flaw caused by improper object sanitization. The stated affected range is later than 0.0.12 and earlier than 1.1.30. Exploitation requires a vulnerable Bun API path accepting attacker-influenced objects; the CVSS 4.0 score is 7.7.

Likely exposure

Exposure is most likely where Bun versions 0.0.13 through 1.1.29 process attacker-controlled objects through affected APIs. The unrelated historical npm package named bun at version 0.0.12 or earlier is explicitly excluded.

Exploitation context

The CVSS vector records network reachability, low complexity, low privileges, no user interaction, and proof-of-concept maturity. CISA KEV status is false in the bundle, and no supplied evidence establishes active exploitation.

Researcher notes

The bundle contains inconsistent version metadata: its narrative identifies versions after 0.0.12 and before 1.1.30, while the structured affected entry lists 0.0.12. The narrative also explicitly excludes 0.0.12 and earlier as another project. Validate findings against the CVE record and linked Bun change.

Mitigation direction

  • Upgrade the Bun runtime to version 1.1.30 or later.
  • Prioritize internet-facing services that pass untrusted objects into Bun APIs.
  • Restrict untrusted object input until upgrading is complete.
  • Review Bun's linked patch and vendor guidance before deployment.

Validation and detection

  • Inventory runtime versions using deployment manifests, lockfiles, containers, and production telemetry.
  • Confirm no deployed Bun runtime falls between 0.0.13 and 1.1.29.
  • Trace attacker-controlled objects reaching Bun APIs and prioritize those paths.
  • Run existing regression and security tests after upgrading.
  • Verify production artifacts contain the intended fixed runtime version.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-1321: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-21548 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.7 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.7CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P——snyk
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P1.65.9snyk

Vulnerability scoring details

Base CVSS 4.0 score

7.7High
CVSS 4.0 vector shape for CVE-2024-21548Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/abun0.0.12Listed
Weakness

CWE details

CWE-1321

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.