Description
janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | cool-path | <= 1.1.2 | — | GHSA-4h4x-4m75-47j4 |
| npm | depath | <= 1.0.6 | — | GHSA-4h4x-4m75-47j4 |