Description
Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “__proto__”.
Published: 2023-08-01
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-2296 Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “__proto__”.
Github GHSA Github GHSA GHSA-gpvc-mx6g-cchv underscore-keypath vulnerable to Prototype Pollution
History

Thu, 17 Oct 2024 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Underscore-keypath Project Underscore-keypath
cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published:

Updated: 2024-10-17T18:59:07.871Z

Reserved: 2023-02-20T10:28:48.926Z

Link: CVE-2023-26139

cve-icon Vulnrichment

Updated: 2024-08-02T11:39:06.606Z

cve-icon NVD

Status : Modified

Published: 2023-08-01T05:15:34.843

Modified: 2024-11-21T07:50:51.520

Link: CVE-2023-26139

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses