~ / search / GHSA-p92x-r36w-9395

GHSA-p92x-r36w-9395

Type confusion in mpath

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23438

Packages

EcosystemPackageAffectedFixed in
npm mpath < 0.8.4 0.8.4

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition `ignoreProperties.indexOf(parts[i]) !== -1` returns `-1` if `parts[i]` is `['__proto__']`. This is because the method that has been called if the input is an array is `Array.prototype.indexOf()` and not `String.prototype.indexOf()`. They behave differently depending on the type of the input.

References

External links from the advisory. They lead to third-party sites.