CVE-2022-25296: The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be t

This month

MEDIUM 6.3UPGRADE

CVE-2022-25296 is a medium-severity flaw (CVSS 6.3) affecting bodymen. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix to [CVE-2019-10792](https://security.snyk.io/vuln/SNYK-JS-BODYMEN-548897)

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	6.3 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	1.0% (top 38%)
CISA exploited list	No
Weakness	CWE-1321
Published	2022-03-17
Last modified	2026-06-17

Publisher (CNA): Snyk · Vendor: bodymen project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-03-17 12:15 UTCPublished CVE record published
2026-06-17 04:33 UTCUpdated Record last modified

bodymen project bodymen UPGRADE

Affected: <= 1.1.1

Fixed in: newer than 1.1.1

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls bodymen

2. UPGRADE to newer than 1.1.1

npm install bodymen@">1.1.1"

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-25296?

bodymen: upgrade to newer than 1.1.1. Exact commands for each OS are on this page.

Is CVE-2022-25296 being exploited?

CVE-2022-25296 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-25296 affect?

CVE-2022-25296 affects bodymen. Severity is medium (CVSS 6.3). The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives fro

How urgent is CVE-2022-25296?

Priority 43/100. Public exploit reference

Related CVEs

CVE-2019-10792 MEDIUM 6.3 UPGRADE bodymen before 1.1.1 is vulnerable to Prototype Pollution

References

← Back to latest CVEs