Prototype Pollution Affecting shvl package, versions >=1.0.0 <2.0.2



    Attack Complexity Low
    Availability High

    Threat Intelligence

    EPSS 0.52% (74th percentile)
Expand this section
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-SHVL-1054936
  • published 30 Dec 2020
  • disclosed 30 Dec 2020
  • credit Unknown

How to fix?

Upgrade shvl to version 2.0.2 or higher.


shvl is a Get and set dot-notated properties within an object

Affected versions of this package are vulnerable to Prototype Pollution. It allows an attacker to cause a denial of service and may lead to remote code execution.