GitHub Advisoryadvisory · npm
GHSA-hc9w-4p87-j549 Prototype Pollution in cached-path-relative
HIGH
Official page ↗
- Aliases
- CVE-2018-16472
- Ecosystem
- npm
- Packages
- cached-path-relative
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-20, CWE-400
- Reviewed
- 2020-06-16
Affected packages
• npm cached-path-relative: < 1.0.2 → fixed in 1.0.2
Description
Version of `cached-path-relative` before 1.0.2 are vulnerable to prototype pollution.
Recommendation
Update to version 1.0.2 or later.
Related
Alias · CVE (1)
- CVE-2018-16472 A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-16472 advisory
- https://github.com/ashaffer/cached-path-relative/issues/3 web
- https://hackerone.com/reports/390847 web
- https://github.com/advisories/GHSA-hc9w-4p87-j549 advisory
- https://github.com/nodejs/security-wg/blob/master/vuln/npm/480.json web
- https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html web
- https://www.npmjs.com/advisories/739 web