CVE-2021-23507 Prototype Pollution
Prototype pollution in object-path-set allows attackers to modify object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23507?
CVE-2021-23507 is a high-severity vulnerability in object-path-set, published on 4 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908
Weakness: CWE-1321
Which versions are affected by CVE-2021-23507?
2 open source packages ship an affected version, including object-path-set. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
object-path-set npm | All versions | 1.0.2 |
object-path-set npm | All versions | 1.0.2 |
Products include Skratchdot Object-Path-Set.
How do I fix CVE-2021-23507?
Upgrade object-path-set to 1.0.2 or later.
Is CVE-2021-23507 being exploited?
There is no known exploitation of CVE-2021-23507 in the wild and no public exploit code.
Sources
Also known as GHSA-h6pr-c536-6rjg, SNYK-JS-OBJECTPATHSET-2388576.