CVE-2024-21548 HIGH

CVE-2024-21548

Vendor N/A
Product bun
Weakness CWE-1321
Published December 18, 2024
Last update July 24, 2025

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P

What the vulnerability does

01Description

Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. **Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past.

Key dates

02Disclosure timeline

December 18, 2024 CVE published
July 24, 2025 Record updated