Prototype Pollution in object-path-set

KRITISCH 9.8CVE-2021-23507 · GHSA-h6pr-c536-6rjg · SNYK-JS-OBJECTPATHSET-2388576 · Published 04/02/2022 · updated 17/06/2026

Kurz gesagt

CVE-2021-23507 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in object-path-set (skratchdot), object-path-set.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.1%, höher als bei 82.0% aller Schwachstellen.
Abhilfe: auf 1.0.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
object-path-set skratchdot	`< 1.0.2`	`1.0.2`
object-path-set npm	`< 1.0.2`	`1.0.2`

Description

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908

NVD description

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908

References

nvd.nist.gov/vuln/detail/CVE-2021-23507 · ADVISORY
skratchdot/object-path-set commit 2d67a71 · WEB
skratchdot/object-path-set · WEB
skratchdot/object-path-set · WEB
snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation · WEB
snyk.io/vuln/SNYK-JS-OBJECTPATHSET-2388576 · WEB
snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

object-path-set

skratchdot

< 1.0.2

1.0.2

object-path-set

npm

< 1.0.2

1.0.2

Description

NVD description