Video Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

The plugin-transform-private-property-in-object plugin is designed to modify how private properties within JavaScript objects are handled. A vulnerability within this plugin could allow an attacker to bypass intended access controls and manipulate object properties in unexpected ways. This could lead to arbitrary code execution if the plugin is used in a context where it can influence the execution flow. The potential blast radius depends on the plugin's integration within the application and the privileges of the Node.js process. Successful exploitation could result in data breaches, system compromise, or denial of service.

Applications and services that rely on the plugin-transform-private-property-in-object plugin within Node.js version 213.21.24 are at risk. This includes projects utilizing this plugin for object property manipulation or those integrating it as a dependency.

• nodejs / server:

  npm list plugin-transform-private-property-in-object

• nodejs / server:

  npm audit

• generic web: Examine package.json files for dependencies including plugin-transform-private-property-in-object.

1. 2024-10-16Disclosure

   disclosure

1. 予約済み2024-10-09
2. 公開日2024-12-06
3. EPSS 更新日2026-04-02

Currently, there is no official patch available for CVE-2024-9769. As a temporary workaround, consider disabling or removing the plugin-transform-private-property-in-object plugin if it is not essential for your application's functionality. Carefully review any third-party dependencies that utilize this plugin and assess their potential impact. Monitor the Node.js community and security advisories for updates and a confirmed fix. Implement robust input validation and sanitization practices to minimize the potential impact of any vulnerabilities.