GHSA-qhxh-9hhx-6p7v
Prototype Pollution in GraphHopper
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.graphhopper:graphhopper-web-bundle | < 3.2 | 3.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
This affects the package `com.graphhopper:graphhopper-web-bundle` before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.
References
External links from the advisory. They lead to third-party sites.