Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

aurelia-path

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.1npmAmendedPublished

    Prototype pollution in aurelia-path

    CVE-2021-41097 · GHSA-3c9c-2p65-qvwv

    Affected
    • npm aurelia-path < 1.1.7
    Fixed in
    1.1.7· Vendor fix available
    Issue
    Impact The vulnerability exposes Aurelia application that uses aurelia-path package to parse a string. The majority of this will be Aurelia applications that employ the aurelia-router package. An example is this could allow an attacker to change the prototype of base object class Object by tricking an application to parse the following URL: https://aurelia.io/blog/?proto[asdf]=asdf Patches The problem should be patched in version 1.1.7. Any version earlier than this is vulnerable. Workarounds A partial work around is to free the Object prototype:

    Recommended action: Upgrade to 1.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →