high7.5
CVE-2021-3805
Prototype Pollution in object-path
Impact
object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). The `del()` function fails to validate which Object properties it deletes. This allows attackers to modify the prototype of Object, causing the modification of default properties like `toString` on all objects.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | object-path | < 0.11.8 | 0.11.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Object-Path Project | Object-Path | before 0.11.8 |
| Debian | Debian Linux | Version 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mariocasciaro/object-path/commit/e6bb638ffdd431176701b3e9024f80050d0ef0a6
- https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053
- https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html
- https://github.com/advisories/GHSA-8v63-cqqc-6r2c
- https://nvd.nist.gov/vuln/detail/CVE-2021-3805
- https://github.com/mariocasciaro/object-path/commit/4f0903fd7c832d12ccbe0d9c3d7e25d985e9e884