Vulnerability Search Examples · Example 5 of 8 in Operators

Contains All: Descriptions With a Word

POSThttps://api.deepinfo.com/v1/discovery/vulnerability-search

CVEs whose description contains the word pollution, as in prototype pollution.

Field: descriptions.value
Operator: contains_all

contains_all matches text that contains its item. On this endpoint the list must hold a single word: even a two-word phrase such as prototype pollution is answered with HTTP 400 ("Value must be a single item in the list for 'contains_all' query").

In the response, look at results[].descriptions[].value.

Request

curl

curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "descriptions.value",
        "type": "contains_all",
        "value": [
          "pollution"
        ]
      }
    ]
  }
}'

Python

import requests

url = "https://api.deepinfo.com/v1/discovery/vulnerability-search"

params = {
    "page_size": "25"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
}

payload = {
    "filters": {
        "must": [
            {
                "name": "descriptions.value",
                "type": "contains_all",
                "value": [
                    "pollution"
                ]
            }
        ]
    }
}

response = requests.post(url, params=params, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    filters: {
      must: [
        {
          name: "descriptions.value",
          type: "contains_all",
          value: [
            "pollution"
          ]
        }
      ]
    }
  }),
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	payload := strings.NewReader(`{
  "filters": {
    "must": [
      {
        "name": "descriptions.value",
        "type": "contains_all",
        "value": [
          "pollution"
        ]
      }
    ]
  }
}`)

	req, err := http.NewRequest("POST", "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25", payload)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String body = """
            {
              "filters": {
                "must": [
                  {
                    "name": "descriptions.value",
                    "type": "contains_all",
                    "value": [
                      "pollution"
                    ]
                  }
                ]
              }
            }""";

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

var body = """
    {
      "filters": {
        "must": [
          {
            "name": "descriptions.value",
            "type": "contains_all",
            "value": [
              "pollution"
            ]
          }
        ]
      }
    }
    """;

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$body = <<<'JSON'
{
  "filters": {
    "must": [
      {
        "name": "descriptions.value",
        "type": "contains_all",
        "value": [
          "pollution"
        ]
      }
    ]
  }
}
JSON;

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25')

request = Net::HTTP::Post.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = <<~'JSON'.chomp
  {
    "filters": {
      "must": [
        {
          "name": "descriptions.value",
          "type": "contains_all",
          "value": [
            "pollution"
          ]
        }
      ]
    }
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Shortened for this page: results: 3 of 25 shown; results[].enrichment.cwe[].capec_id: first 10 items

Response Body

{
  "page": 1,
  "page_size": 25,
  "result_count": 446,
  "results": [
    {
      "id": "CVE-2026-25881",
      "source_identifier": "user@github.com",
      "published": "2026-02-09T22:16:03Z",
      "last_modified": "2026-06-17T10:25:22Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": null,
      "cisa_action_due": null,
      "cisa_required_action": null,
      "cisa_vulnerability_name": null,
      "descriptions": [
        {
          "lang": "en",
          "value": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries. When a global prototype reference (e.g., Map.prototype, Set.prototype) is placed into an array and retrieved, the isGlobal taint is stripped, permitting direct prototype mutation from within the sandbox. This results in persistent host-side prototype pollution and may enable RCE in applications that use polluted properties in sensitive sinks (example gadget: execSync(obj.cmd)). This vulnerability is fixed in 0.8.31."
        },
        {
          "lang": "es",
          "value": "SandboxJS es una biblioteca de sandboxing de JavaScript. Antes de la versión 0.8.31, una vulnerabilidad de escape de sandbox permite que el código en sandbox mute los prototipos integrados del host al blanquear la bandera de protección 'isGlobal' a través de intermediarios de literales de array. Cuando una referencia de prototipo global (por ejemplo, Map.prototype, Set.prototype) se coloca en un array y se recupera, la marca 'isGlobal' se elimina, permitiendo la mutación directa del prototipo desde dentro del sandbox. Esto resulta en una contaminación persistente de prototipos del lado del host y puede habilitar RCE en aplicaciones que usan propiedades contaminadas en sumideros sensibles (ejemplo de gadget: execSync(obj.cmd)). Esta vulnerabilidad está corregida en la versión 0.8.31."
        }
      ],
      "references": [
        {
          "url": "https://github.com/nyariv/SandboxJS/commit/f369f8db26649f212a6a9a2e7a1624cb2f705b53",
          "source": "user@github.com",
          "tags": [
            "Patch"
          ]
        },
        {
          "url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-ww7g-4gwx-m7wj",
          "source": "user@github.com",
          "tags": [
            "Exploit",
            "Mitigation",
            "Vendor Advisory"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@github.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "HIGH",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 9.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 2.2,
            "impact_score": 6.0
          },
          {
            "source": "user@nist.gov",
            "type": "Primary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@github.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-1321"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*",
                  "match_criteria_id": "626B7924-ECB8-4661-A9FA-3A12B095F1DE",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "0.8.31"
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*",
            "vendor": "nyariv",
            "product": "sandboxjs",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "0.8.31",
            "affected_versions_first": "0.1.0",
            "affected_versions_last": "0.8.30"
          }
        ],
        "cwe": [
          {
            "id": 1321,
            "owasptop10_2021": null,
            "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
            "description": "The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.",
            "capec_id": [
              1,
              77,
              180
            ],
            "scope": [
              "Availability",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "DoS: Crash, Exit, or Restart",
              "Modify Application Data",
              "Read Application Data"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.0056,
          "percentile": 0.45461,
          "date": "2026-09-23"
        },
        "cisa_kev": null,
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "user@nist.gov",
          "type": "Primary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2026-25586",
      "source_identifier": "user@github.com",
      "published": "2026-02-06T20:16:10Z",
      "last_modified": "2026-06-17T10:24:54Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": null,
      "cisa_action_due": null,
      "cisa_required_action": null,
      "cisa_vulnerability_name": null,
      "descriptions": [
        {
          "lang": "en",
          "value": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to __proto__ and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact. This vulnerability is fixed in 0.8.29."
        },
        {
          "lang": "es",
          "value": "SandboxJS es una librería de sandboxing de JavaScript. Antes de 0.8.29, es posible un escape del sandbox al sombrear hasOwnProperty en un objeto sandbox, lo que deshabilita la aplicación de la lista blanca de prototipos en la ruta de acceso a propiedades. Esto permite el acceso directo a __proto__ y otras propiedades de prototipo bloqueadas, lo que permite la contaminación del Object.prototype del host y un impacto persistente entre sandboxes. Esta vulnerabilidad está corregida en 0.8.29."
        }
      ],
      "references": [
        {
          "url": "https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3",
          "source": "user@github.com",
          "tags": [
            "Patch"
          ]
        },
        {
          "url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-jjpw-65fv-8g48",
          "source": "user@github.com",
          "tags": [
            "Exploit",
            "Vendor Advisory"
          ]
        },
        {
          "url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-jjpw-65fv-8g48",
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "tags": [
            "Exploit",
            "Vendor Advisory"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@github.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@github.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-74"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*",
                  "match_criteria_id": "5822AD4C-2C8E-4196-9149-A626F0572E05",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "0.8.29"
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*",
            "vendor": "nyariv",
            "product": "sandboxjs",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "0.8.29",
            "affected_versions_first": "0.1.0",
            "affected_versions_last": "0.8.28"
          }
        ],
        "cwe": [
          {
            "id": 74,
            "owasptop10_2021": "A03 Injection",
            "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
            "description": "The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.",
            "capec_id": [
              3,
              6,
              7,
              8,
              9,
              10,
              13,
              14,
              24,
              28
            ],
            "scope": [
              "Access Control",
              "Confidentiality",
              "Integrity",
              "Non-Repudiation",
              "Other"
            ],
            "impact": [
              "Alter Execution Logic",
              "Bypass Protection Mechanism",
              "Hide Activities",
              "Other",
              "Read Application Data"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.00648,
          "percentile": 0.49662,
          "date": "2026-09-23"
        },
        "cisa_kev": null,
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "user@github.com",
          "type": "Secondary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    },
    {
      "id": "CVE-2026-25150",
      "source_identifier": "user@github.com",
      "published": "2026-02-03T22:16:30Z",
      "last_modified": "2026-06-17T10:24:11Z",
      "status": "Analyzed",
      "evaluator_comment": null,
      "evaluator_solution": null,
      "evaluator_impact": null,
      "cisa_exploit_add": null,
      "cisa_action_due": null,
      "cisa_required_action": null,
      "cisa_vulnerability_name": null,
      "descriptions": [
        {
          "lang": "en",
          "value": "Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0."
        },
        {
          "lang": "es",
          "value": "Qwik es un framework de javascript centrado en el rendimiento. Antes de la versión 1.19.0, existe una vulnerabilidad de contaminación de prototipos en la función formToObj() dentro del middleware @builder.io/qwik-city. La función procesa los nombres de los campos del formulario con notación de puntos (por ejemplo, user.name) para crear objetos anidados, pero no logra sanear nombres de propiedades peligrosos como __proto__, constructor y prototype. Esto permite a atacantes no autenticados contaminar Object.prototype enviando solicitudes HTTP POST manipuladas, lo que podría conducir a escalada de privilegios, omisión de autenticación o denegación de servicio. Este problema ha sido parcheado en la versión 1.19.0."
        }
      ],
      "references": [
        {
          "url": "https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7",
          "source": "user@github.com",
          "tags": [
            "Patch"
          ]
        },
        {
          "url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq",
          "source": "user@github.com",
          "tags": [
            "Vendor Advisory"
          ]
        }
      ],
      "metrics": {
        "cvss_metric_v40": null,
        "cvss_metric_v31": [
          {
            "source": "user@github.com",
            "type": "Secondary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "NONE",
              "integrity_impact": "HIGH",
              "availability_impact": "LOW",
              "base_score": 9.3,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 4.7
          },
          {
            "source": "user@nist.gov",
            "type": "Primary",
            "cvss_data": {
              "version": "3.1",
              "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "attack_vector": "NETWORK",
              "attack_complexity": "LOW",
              "privileges_required": "NONE",
              "user_interaction": "NONE",
              "scope": "CHANGED",
              "confidentiality_impact": "HIGH",
              "integrity_impact": "HIGH",
              "availability_impact": "HIGH",
              "base_score": 10.0,
              "base_severity": "CRITICAL",
              "exploit_code_maturity": null,
              "remediation_level": null,
              "report_confidence": null,
              "temporal_score": null,
              "temporal_severity": null,
              "confidentiality_requirement": null,
              "integrity_requirement": null,
              "availability_requirement": null,
              "modified_attack_vector": null,
              "modified_attack_complexity": null,
              "modified_privileges_required": null,
              "modified_user_interaction": null,
              "modified_scope": null,
              "modified_confidentiality_impact": null,
              "modified_integrity_impact": null,
              "modified_availability_impact": null,
              "environmental_score": null,
              "environmental_severity": null
            },
            "exploitability_score": 3.9,
            "impact_score": 6.0
          }
        ],
        "cvss_metric_v30": null,
        "cvss_metric_v2": null
      },
      "weaknesses": [
        {
          "source": "user@github.com",
          "type": "Secondary",
          "description": [
            {
              "lang": "en",
              "value": "CWE-1321"
            }
          ]
        }
      ],
      "configurations": [
        {
          "operator": null,
          "negate": null,
          "nodes": [
            {
              "operator": "OR",
              "negate": false,
              "cpe_match": [
                {
                  "vulnerable": true,
                  "criteria": "cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:*",
                  "match_criteria_id": "8A329D09-A8EB-4297-8BD9-4E862179FE54",
                  "version_start_including": null,
                  "version_start_excluding": null,
                  "version_end_including": null,
                  "version_end_excluding": "1.19.0"
                }
              ]
            }
          ]
        }
      ],
      "vendor_comments": null,
      "enrichment": {
        "cpe": [
          {
            "criteria": "cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:*",
            "vendor": "qwik",
            "product": "qwik",
            "product_type": "a",
            "vulnerable": true,
            "version_start_including": null,
            "version_start_excluding": null,
            "version_end_including": null,
            "version_end_excluding": "1.19.0",
            "affected_versions_first": "0.0.11",
            "affected_versions_last": "1.18.0"
          }
        ],
        "cwe": [
          {
            "id": 1321,
            "owasptop10_2021": null,
            "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
            "description": "The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.",
            "capec_id": [
              1,
              77,
              180
            ],
            "scope": [
              "Availability",
              "Confidentiality",
              "Integrity"
            ],
            "impact": [
              "DoS: Crash, Exit, or Restart",
              "Modify Application Data",
              "Read Application Data"
            ],
            "detection_method": [
              "Automated Static Analysis"
            ]
          }
        ],
        "epss_score": {
          "epss": 0.00662,
          "percentile": 0.50259,
          "date": "2026-09-23"
        },
        "cisa_kev": null,
        "vdeep_metric": {
          "available_versions": [
            "3.1"
          ],
          "source": "user@nist.gov",
          "type": "Primary",
          "cvss_data": {
            "version": "3.1",
            "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "attack_vector": "NETWORK",
            "attack_complexity": "LOW",
            "attack_requirements": null,
            "privileges_required": "NONE",
            "user_interaction": "NONE",
            "vulnerable_system_confidentiality": "HIGH",
            "vulnerable_system_integrity": "HIGH",
            "vulnerable_system_availability": "HIGH",
            "subsequent_system_confidentiality": null,
            "subsequent_system_integrity": null,
            "subsequent_system_availability": null,
            "exploit_maturity": null,
            "confidentiality_requirements": null,
            "integrity_requirements": null,
            "availability_requirements": null,
            "modified_attack_vector": null,
            "modified_attack_complexity": null,
            "modified_attack_requirements": null,
            "modified_privileges_required": null,
            "modified_user_interaction": null,
            "modified_vulnerable_system_confidentiality": null,
            "modified_vulnerable_system_integrity": null,
            "modified_vulnerable_system_availability": null,
            "modified_subsequent_system_confidentiality": null,
            "modified_subsequent_system_integrity": null,
            "modified_subsequent_system_availability": null,
            "safety": null,
            "automatable": null,
            "recovery": null,
            "value_density": null,
            "vulnerability_response_effort": null,
            "provider_urgency": null,
            "base_score": 10.0,
            "base_severity": "CRITICAL"
          }
        }
      }
    }
  ]
}

Content-Type: application/json
ratelimit-limit: 1
ratelimit-remaining: 0
ratelimit-reset: 1
x-ratelimit-limit-second: 1
x-ratelimit-remaining-second: 0
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Request

What this example sends. Every parameter is documented on Search; the exact request is in the code panel.

Parameter	Value
`page_size`query	`25`
`filters.must[0].name`body	`descriptions.value`
`filters.must[0].type`body	`contains_all`
`filters.must[0].value`body	`["pollution"]`

Reference updated September 26, 2026

Request

Related Examples