Prototype Pollution in object-path-set

CRITICAL 9.8CVE-2021-23507 · GHSA-h6pr-c536-6rjg · SNYK-JS-OBJECTPATHSET-2388576 · Published 04/02/2022 · updated 17/06/2026

In short

CVE-2021-23507 is a CRITICAL (CVSS 9.8) vulnerability affecting object-path-set (skratchdot), object-path-set.
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 82.0% of all vulnerabilities.
Fix: update to 1.0.2 or later.

Package	Affected versions	Patched versions
object-path-set skratchdot	`< 1.0.2`	`1.0.2`
object-path-set npm	`< 1.0.2`	`1.0.2`

Description

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908

NVD description

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908

References

nvd.nist.gov/vuln/detail/CVE-2021-23507 · ADVISORY
skratchdot/object-path-set commit 2d67a71 · WEB
skratchdot/object-path-set · WEB
skratchdot/object-path-set · WEB
snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation · WEB
snyk.io/vuln/SNYK-JS-OBJECTPATHSET-2388576 · WEB
snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

object-path-set

skratchdot

< 1.0.2

1.0.2

object-path-set

npm

< 1.0.2

1.0.2

Description

NVD description