GHSA-gpvc-mx6g-cchv

Source

https://github.com/advisories/GHSA-gpvc-mx6g-cchv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-gpvc-mx6g-cchv/GHSA-gpvc-mx6g-cchv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gpvc-mx6g-cchv

Aliases

CVE-2023-26139

Published

2023-08-01T06:30:15Z

Modified

2023-11-08T04:11:59.621730Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

underscore-keypath vulnerable to Prototype Pollution

Details

Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like __proto__.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-01T19:47:09Z",
    "nvd_published_at": "2023-08-01T05:15:34Z",
    "cwe_ids": [
        "CWE-1321"
    ],
    "severity": "HIGH"
}

References

Affected packages

npm / underscore-keypath

Package

Name: underscore-keypath; View open source insights on deps.dev
Purl: pkg:npm/underscore-keypath

Affected ranges

Type: SEMVER
Events: Introduced

0.0.11

Last affected

0.9.3