~ / search / GHSA-4c2g-hx49-7h25

GHSA-4c2g-hx49-7h25

Prototype pollution not blocked by object-path related utilities in hoolock

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-23339

Packages

EcosystemPackageAffectedFixed in
npm hoolock >= 2.0.0, < 2.2.1 2.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Utility functions related to object paths (`get`, `set` and `update`) did not block attempts to access or alter object prototypes. ### Patches The `get`, `set` and `update` functions will throw a `TypeError` when a user attempts to access or alter inherited properties in versions >=2.2.1.

References

External links from the advisory. They lead to third-party sites.