| Package | Affected versions | Patched versions |
|---|---|---|
| com.graphhopper:graphhopper-web-bundle | < 3.2 | 3.2 |
| graphhopper | = 4.0< 3.2 | 3.2 |
This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or proto payload.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free