Prototype pollution not blocked by object-path related utilities in hoolock

中 6.5CVE-2024-23339 · GHSA-4c2g-hx49-7h25 · 22/01/2024 公開 · 17/06/2026 更新

要点

CVE-2024-23339 は hoolock (elijahharry), hoolock に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.0%（全脆弱性の 63.2% より高い）。
対処：2.2.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
hoolock elijahharry	`≥ 2.0.0, < 2.2.1`	`2.2.1`
hoolock npm	`≥ 2.0.0, < 2.2.1`	`2.2.1`

概要

Impact

Utility functions related to object paths (get, set and update) did not block attempts to access or alter object prototypes.

Patches

The get, set and update functions will throw a TypeError when a user attempts to access or alter inherited properties in versions >=2.2.1.

NVD の説明

hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block attempts to access or alter object prototypes. Starting in version 2.2.1, the `get`, `set` and `update` functions throw a `TypeError` when a user attempts to access or alter inherited properties.