Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). The del() function fails to validate which Object properties it deletes. This allows attackers to modify the prototype of Object, causing the modification of default properties like toString on all objects.
Recommended action: Upgrade to 0.11.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === 'proto' returns false if currentPath is ['proto']. This is because the === operator returns always false when the type of the operands is different.
Recommended action: Upgrade to 0.11.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A prototype pollution vulnerability has been found in object-path <= 0.11.4 affecting the set() method. The vulnerability is limited to the includeInheritedProps mode (if version = 0.11.0 is used), which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is not affected by the vulnerability if version = 0.11.0 is used. Any usage of set() in versions < 0.11.0 is vulnerable. Patches Upgrade to version = 0.11.5 Workarounds Don't use the includeInheritedProps: true options or the withInheritedProps instance if using a version = 0.11.0. References Read more about the prototype pollution vulnerability For more information If you have any questions or comments about this advisory: Open an issue in object-path
Recommended action: Upgrade to 0.11.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.