{"id":"CVE-2020-28458","aliases":["GHSA-m7j4-fhg6-xf5v"],"url":"https://o3.security/vulnerability/CVE-2020-28458","summary":"datatables.net vulnerable to Prototype Pollution due to incomplete fix","details":"All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.","published":"2020-12-16T11:15:12.130Z","modified":"2026-07-08T20:30:34.071069Z","cvss":{"score":7.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"npm","name":"datatables.net","fixedVersion":"1.10.22"}],"fix":{"url":"https://github.com/DataTables/DataTablesSrc/commit/a51cbe99fd3d02aa5582f97d4af1615d11a1ea03","label":"DataTables/DataTablesSrc@a51cbe9"},"references":[{"type":"ADVISORY","url":"https://github.com/DataTables/Dist-DataTables/blob/master/js/jquery.dataTables.js%23L2766"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240621-0006/"},{"type":"ADVISORY","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1051961"},{"type":"ADVISORY","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1051962"},{"type":"ADVISORY","url":"https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402"},{"type":"FIX","url":"https://github.com/DataTables/DataTablesSrc/commit/a51cbe99fd3d02aa5582f97d4af1615d11a1ea03"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T20:30:34.071069Z"}}