CVE-2023-30857

@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.

• CWE-1321

• https://github.com/aedart/ion/commit/c3e2ee08710d4164d796ecb66ed291335dae9291Patch
• https://github.com/aedart/ion/security/advisories/GHSA-wwxh-74fx-33c6Vendor Advisory
• https://github.com/aedart/ion/commit/c3e2ee08710d4164d796ecb66ed291335dae9291Patch
• https://github.com/aedart/ion/security/advisories/GHSA-wwxh-74fx-33c6Vendor Advisory

Published

Apr 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30851Cilium is a networking, observability, and security solution…5.3
• CVE-2023-30852Pimcore is an open source data and experience management pla…4.9
• CVE-2023-30853Gradle Build Action allows users to execute a Gradle Build i…6.5
• CVE-2023-30854AVideo is an open source video platform. Prior to version 12…8.8
• CVE-2023-30855Pimcore is an open source data and experience management pla…7.5
• CVE-2023-30856eDEX-UI is a science fiction terminal emulator. Versions 2.2…10
• CVE-2023-30858The Denosaurs emoji package provides emojis for dinosaurs. S…7.5
• CVE-2023-30859Triton is a Minecraft plugin for Spigot and BungeeCord that …9.8
• CVE-2023-3086Cross-site Scripting (XSS) - Stored in GitHub repository nil…9
• CVE-2023-30860WWBN AVideo is an open source video platform. In AVideo prio…5.4
• CVE-2023-30861Flask is a lightweight WSGI web application framework. When …7.5
• CVE-2023-30863In Connectivity Service, there is a possible missing permiss…7.8