Skip to content
OpenAdvisories
High · 7.3 Public exploit CVE-2023-45827 EUVD-2023-2942GHSA-9w5f-mw3p-pj47

Prototype Pollution vulnerability in @clickbar/dot-diver

Published Nov 6, 2023 · Updated Sep 4, 2024 · Assigned by GitHub_M

Vendor: clickbar Product: dot-diver Package: @clickbar/dot-diver Ecosystem: npm

Description

Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.

Affected products

VendorProductAffectedFixed
clickbar dot-diver < 1.0.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm @clickbar/dot-diver < 1.0.2 1.0.2 GHSA-9w5f-mw3p-pj47

References