medium6.3
CVE-2024-23339
Prototype pollution not blocked by object-path related utilities in hoolock
Impact
### Impact Utility functions related to object paths (`get`, `set` and `update`) did not block attempts to access or alter object prototypes. ### Patches The `get`, `set` and `update` functions will throw a `TypeError` when a user attempts to access or alter inherited properties in versions >=2.2.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | hoolock | >= 2.0.0, < 2.2.1 | 2.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elijahharry | Hoolock | from 2.0.0 before 2.2.1 |