GitHub Advisoryadvisory · npm

GHSA-gpvc-mx6g-cchv underscore-keypath vulnerable to Prototype Pollution

HIGH Published 2023-08-01 Modified 2023-08-01 Official page ↗
Aliases
CVE-2023-26139
Ecosystem
npm
Packages
underscore-keypath
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321
Reviewed
2023-08-01

Affected packages

• npm underscore-keypath: >= 0.0.11, <= 0.9.3 (no fix yet)

Description

Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the `setProperty()` function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like `__proto__`.

Related

Alias · CVE (1)

  • CVE-2023-26139 Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty()… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References