GitHub Advisoryadvisory · npm

GHSA-8v63-cqqc-6r2c Prototype Pollution in object-path

HIGH Published 2021-09-20 Modified 2022-08-11 Official page ↗
Aliases
CVE-2021-3805
Ecosystem
npm
Packages
object-path
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-09-20

Affected packages

• npm object-path: < 0.11.8 → fixed in 0.11.8

Description

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). The `del()` function fails to validate which Object properties it deletes. This allows attackers to modify the prototype of Object, causing the modification of default properties like `toString` on all objects.

Related

Alias · CVE (1)

  • CVE-2021-3805 object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References