Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04djYzLWNxcWMtNnIyY80V4w

Prototype Pollution in object-path

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). The del() function fails to validate which Object properties it deletes. This allows attackers to modify the prototype of Object, causing the modification of default properties like toString on all objects.

Permalink: https://github.com/advisories/GHSA-8v63-cqqc-6r2c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04djYzLWNxcWMtNnIyY80V4w
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: 5 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-8v63-cqqc-6r2c, CVE-2021-3805
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-3805
• https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053
• https://github.com/mariocasciaro/object-path/commit/4f0903fd7c832d12ccbe0d9c3d7e25d985e9e884
• https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html
• https://github.com/advisories/GHSA-8v63-cqqc-6r2c

Repository: https://github.com/mariocasciaro/object-path
Blast Radius: 44.8

Affected Packages