GitHub Advisoryadvisory · npm

GHSA-4c2g-hx49-7h25 Prototype pollution not blocked by object-path related utilities in hoolock

MEDIUM Published 2024-01-23 Modified 2024-01-23 Official page ↗
Aliases
CVE-2024-23339
Ecosystem
npm
Packages
hoolock
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321
Reviewed
2024-01-23

Affected packages

• npm hoolock: >= 2.0.0, < 2.2.1 → fixed in 2.2.1

Description

Impact Utility functions related to object paths (`get`, `set` and `update`) did not block attempts to access or alter object prototypes. Patches The `get`, `set` and `update` functions will throw a `TypeError` when a user attempts to access or alter inherited properties in versions >=2.2.1.

Related

Alias · CVE (1)

  • CVE-2024-23339 hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References