CVE-2023-38894
Critical · CVSS 9.8tree-kit — Prototype Pollution
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-1321
Description
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.
Search profile — drives PoC discovery
Symbols extendtree-kittreeKit__proto__constructorprototype
Keywords CVE-2023-38894tree-kittreekitprototype pollutionextend functioncronvelnpm tree-kitCWE-1321
Versions: <=0.7.4
Ranked PoCs (1) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0AmirF00/ProtoType-Pollution needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
Affected packages
| npm | tree-kit | 0 → 0.7.5 |
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T18:30:39.000Z