NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
MEDIUM severity

Sentry SDK Prototype Pollution gadget in JavaScript SDKsGHSA-593m-55hh-j8gv

MEDIUMFix: getsentry/sentry-javascript#13838

GHSA-593m-55hh-j8gv is a medium-severity (CVSS 5.6) vulnerability in @sentry/browser. A fix is available for @sentry/browser — see the affected versions and patch details below.

Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 4, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

1Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@sentry/browsernpm
52.0Mdownloads / week

Description

Impact

In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.

[!NOTE] This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.

Patches

The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version. Also, the fix was backported to SDK v7 in 7.119.1.

References

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npm@sentry/browser≥ 8.0.0-alpha.1&&< 8.33.08.33.0npm install @sentry/browser@8.33.0
📦npm@sentry/browserall versions7.119.1npm install @sentry/browser@7.119.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @sentry/browser, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update @sentry/browser to 8.33.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-593m-55hh-j8gv is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue. > [!NOTE] > This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk. ### Patches The issue was patched in all Sentr
O3 Security · Impact-Aware SCA

Is GHSA-593m-55hh-j8gv in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Sentry SDK Prototype Pollution gadget in JavaScript SDKs