CVE-2020-7768— Prototype Pollution
Quick assessment
Affected
n/a grpc
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
grpc是云原生计算（Cloud Native Computing Foundation）基金会的一个应用于rpc连接的代码库。 grpc 1.24.4之前版本存在安全漏洞，该漏洞源于@grpc grpc-js容易受到loadPackageDefinition的原型污染。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-7768
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Prototype Pollution
Source: CVE Program / CVE List V5
Vulnerability Description
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
grpc 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
grpc是云原生计算（Cloud Native Computing Foundation）基金会的一个应用于rpc连接的代码库。 grpc 1.24.4之前版本存在安全漏洞，该漏洞源于@grpc grpc-js容易受到loadPackageDefinition的原型污染。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | grpc | unspecified ~ 1.24.4 | - |
|
| - | @grpc/grpc-js | unspecified ~ 1.1.8 | - |
|
II. Public POCs for CVE-2020-7768
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-7768
请登录查看更多情报信息。
Patches & Fixes for CVE-2020-7768 (2)
-
https://github.com/grpc/grpc-node/pull/1606 x_refsource_MISC
-
https://github.com/grpc/grpc-node/pull/1605 x_refsource_MISC
Vendor Advisories for CVE-2020-7768 (3)
-
https://snyk.io/vuln/SNYK-JS-GRPCGRPCJS-1038818 x_refsource_MISC
-
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038819 x_refsource_MISC
-
https://snyk.io/vuln/SNYK-JS-GRPC-598671 x_refsource_MISC
Same Patch Batch · n/a · 2020-11-11 · 4 CVEs total
| CVE-2020-7767 | 5.3 MEDIUM | Regular Expression Denial of Service (ReDoS) |
| CVE-2020-27523 | Mersive Technologies Mersive Solstice-Pod 授权问题漏洞 | |
| CVE-2020-27524 | Audi A7 MMI 2014 格式化字符串错误漏洞 |
IV. Related Vulnerabilities
Same product: grpc
-
CVE-2026-48853
Remote code execution and denial of service via unsafe Erlan -
CVE-2026-53430
grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompr -
CVE-2026-48599
Authorization bypass via path binding override in elixir-grp -
CVE-2026-48854
Unbounded request body accumulation causes memory exhaustion -
CVE-2024-7246
HPACK table poisoning in gRPC C++, Python & Ruby
Same vendor: n/a
-
CVE-2026-105329
TallCMS PluginManager ThemeManager.php code injection -
CVE-2026-105315
django-haystack more_like_this Template Tag elasticsearch_ba -
CVE-2026-105307
Casdoor API Endpoint authz_filter.go ApiFilter missing authe -
CVE-2026-105263
Shaarli Admin Metadata Endpoint MetadataController.php Metad -
CVE-2026-105251
vgmstream VAG File psx_decoder.c ps_find_padding out-of-boun
V. Comments for CVE-2020-7768
No comments yet