Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Blackprint: Executable Code Injection via Prototype Pollution

CVE-2024-24294 · published 2 years ago
Summary

Blackprint, a JavaScript framework, has a vulnerability in its engine that can be exploited to execute arbitrary code. This could allow an attacker to manipulate sensitive data or take control of the application. Update Blackprint to the latest version to fix this issue.

What to do
  • Update blackprint engine to version 0.9.2.
Affected software
Ecosystem VendorProductAffected versions
npm blackprint engine >= 0.8.12, < 0.9.2
Fix: upgrade to 0.9.2
Original advisory text
A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.
A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-1321Prototype Pollution
Timeline
Published20 May 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-g3q2-vcjq-rgrc · GHSA
CVE-2024-24294 · NVD
Track software like this
Free during beta