GHSA-4h4x-4m75-47j4

depath and cool-path vulnerable to Prototype Pollution via `set()` Method

Source: GitHub Advisory Database (reviewed) High CVE-2024-38985

Packages

Ecosystem	Package	Affected	Fixed in
npm	depath	<= 1.0.6	no fix listed
npm	cool-path	<= 1.1.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-38985 advisory
https://github.com/janryWang/depath/issues/11 web
https://gist.github.com/mestrtee/32c0a48023036e51918f6a098f21953d web
https://github.com/janryWang/depath package