GHSA-cwx2-736x-mf6w

Suggest an improvement
Source
https://github.com/advisories/GHSA-cwx2-736x-mf6w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/10/GHSA-cwx2-736x-mf6w/GHSA-cwx2-736x-mf6w.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cwx2-736x-mf6w
Aliases
Published
2020-10-19T20:55:55Z
Modified
2023-11-08T04:02:35.775904Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H CVSS Calculator
Summary
Prototype pollution in object-path
Details

Impact

A prototype pollution vulnerability has been found in object-path <= 0.11.4 affecting the set() method. The vulnerability is limited to the includeInheritedProps mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of set() in versions < 0.11.0 is vulnerable.

Patches

Upgrade to version >= 0.11.5

Workarounds

Don't use the includeInheritedProps: true options or the withInheritedProps instance if using a version >= 0.11.0.

References

Read more about the prototype pollution vulnerability

For more information

If you have any questions or comments about this advisory: * Open an issue in object-path

References

Affected packages

npm / object-path

Package

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.11.5

Ecosystem specific

{
    "affected_functions": [
        "(object-path).set"
    ]
}