Summary
It was discovered that the set() method in object-path could be corrupted
as a result of prototype pollution by sending a message to the parent
process. An attacker could use this issue to cause object-path to crash.
(CVE-2020-15256, CVE-2021-23434, CVE-2021-3805)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | node-object-path | 0.11.3-1ubuntu0.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | node-object-path | 0.11.4-2ubuntu0.1 |
Vulnerabilities 3
-
High 7.7
Prototype pollution in object-path
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new i…
-
High 7.5
Prototype Pollution in mariocasciaro/object-path
object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
Medium 5.6
Prototype Pollution
This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if…