GHSA-6g47-63mv-qpgh

Prototype Pollution in dotty

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23624

Packages

Ecosystem	Package	Affected	Fixed in
npm	dotty	< 0.1.2	0.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23624 advisory
https://github.com/deoxxa/dotty/commit/88f61860dcc274a07a263c32cbe9d44c24ef02d7 web
https://github.com/deoxxa/dotty package
https://snyk.io/vuln/SNYK-JS-DOTTY-1577292 web