CVE-2020-7774

70

FAUCET Score

CVE-2020-7774 describes a critical Prototype Pollution vulnerability in the y18n package versions prior to 3.2.2, 4.0.1, and 5.0.5, impacting products like Oracle GraalVM and Siemens SINEC Infrastructure Network Services. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network without user interaction, potentially leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness among security researchers.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 3.2.2CPE matchmatch criteria	cpe:2.3:a:y18n_project:y18n::::::node.js::*
		>= 5.0.0, < 5.0.5CPE matchmatch criteria	cpe:2.3:a:y18n_project:y18n::::::node.js::*
		4.0.0CPE matchmatch criteria	cpe:2.3:a:y18n_project:y18n:4.0.0:::::node.js::
		19.3.5CPE matchmatch criteria	cpe:2.3:a:oracle:graalvm:19.3.5::::enterprise:::
		20.3.1.2CPE matchmatch criteria	cpe:2.3:a:oracle:graalvm:20.3.1.2::::enterprise:::

CVSS Data

CVSS version used by this source: 3.1

7.3HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

Exploitability Score

3.9

Impact Score

3.4

CvssVersion

3.1

Exploit Intelligence

EPSS Score

69.06%

Probability of exploitation in next 30 days

EPSS Percentile

99.3%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

This CVE's current EPSS score of 0.6906 is in the 97th percentile among its peer group of 36,833 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (32)

github_advisorypatch availablevia nvd_reference

npmpatch availablevia ghsa

Product: y18nFixed in: 4.0.1

npmpatch availablevia ghsa

Product: y18nFixed in: 5.0.5

npmpatch availablevia ghsa

Product: y18nFixed in: 3.2.2

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.8Fixed in: openshift4/ose-thanos-rhel8:v4.8.0-202106291913.p0.git.c358e96.assembly.stream

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Storage 4.7.0 on RHEL-8Fixed in: ocs4/mcg-core-rhel8:5.7.0-60.2c1fdb0.5.7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-nodejs12-nodejs-0:12.19.1-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-nodejs14-nodejs-0:14.15.4-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-nodejs10-nodejs-0:10.23.1-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-nodejs12-nodejs-0:12.19.1-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-nodejs14-nodejs-0:14.15.4-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-nodejs12-nodejs-0:12.19.1-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-nodejs14-nodejs-0:14.15.4-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-nodejs10-nodejs-0:10.23.1-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-nodejs10-nodejs-0:10.23.1-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: nodejs:12-8030020201124152102.229f0a1c

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: nodejs:10-8030020210118191659.229f0a1c

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: nodejs:14-8030020210126165503.229f0a1c

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.7Fixed in: openshift4/ose-grafana:v4.7.0-202102130115.p0

redhatvendor investigatingvia redhat_api

Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-prometheus-rhel9

redhatvendor investigatingvia redhat_api

Product: OpenShift Service Mesh 1Fixed in: servicemesh-grafana

redhatvendor investigatingvia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: openshift3/ose-console

redhatvendor investigatingvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/odf-console-rhel8

redhatvendor investigatingvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/odf-multicluster-console-rhel8

redhatvendor investigatingvia redhat_api

Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-console

redhatno patchvia redhat_api

Product: OpenShift Service Mesh 1Fixed in: kiali

redhatno patchvia redhat_api

Product: OpenShift Service Mesh 2.0Fixed in: servicemesh-grafana

redhatno patchvia redhat_api

Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: y18n

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: noobaa-core-container

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/mcg-core-rhel9

redhatend of lifevia redhat_api

Product: Red Hat Quay 3Fixed in: quay

Vendor Advisories (2)

npmGHSA-c4w7-xm78-47vhhigh

Prototype Pollution in y18n

redhatCVE-2020-7774Moderate

nodejs-y18n: prototype pollution vulnerability

References

cert-portal.siemens.com / productcert/pdf/ssa-389290.pdf

PatchThird Party Advisory

github.com / yargs/y18n/issues/96

ExploitThird Party Advisory

github.com / yargs/y18n/pull/108

PatchThird Party Advisory

snyk.io / vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306

ExploitThird Party Advisory

snyk.io / vuln/SNYK-JS-Y18N-1021887

ExploitThird Party Advisory

oracle.com / security-alerts/cpuApr2021.html

PatchThird Party Advisory