GHSA-8v63-cqqc-6r2c
Prototype Pollution in object-path
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | object-path | < 0.11.8 | 0.11.8 |
Details
As written in the advisory (Markdown source, shown as plain text).
object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). The `del()` function fails to validate which Object properties it deletes. This allows attackers to modify the prototype of Object, causing the modification of default properties like `toString` on all objects.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2021-3805
- https://github.com/mariocasciaro/object-path/commit/4f0903fd7c832d12ccbe0d9c3d7e25d985e9e884
- https://github.com/mariocasciaro/object-path
- https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053
- https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html