{"id":"CVE-2020-7643","aliases":[],"url":"https://o3.security/vulnerability/CVE-2020-7643","summary":"Prototype pollution in paypal-adaptive","details":"paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a `__proto__` payload.","published":"2021-12-10T20:05:57Z","modified":"2026-03-14T10:41:19.113090Z","cvss":{"score":4.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"npm","name":"paypal-adaptive","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7643"},{"type":"PACKAGE","url":"https://github.com/Ideame/paypal-adaptive-sdk-nodejs"},{"type":"WEB","url":"https://github.com/Ideame/paypal-adaptive-sdk-nodejs/blob/master/lib/paypal-adaptive.js#L31"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-PAYPALADAPTIVE-565089"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-03-14T10:41:19.113090Z"}}