Vulnerability · Published Aug 27, 2021 · Assigned by snyk
CVE-2021-23434Prototype Pollution
Medium 5.6
In plain English
A medium-severity security flaw in object-path. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)1.9%top 20.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-object-path | 0.11.7-1 | DEBIAN-CVE-2021-23434 |
| Debian:13 | node-object-path | 0.11.7-1 | DEBIAN-CVE-2021-23434 |
| Debian:14 | node-object-path | 0.11.7-1 | DEBIAN-CVE-2021-23434 |
| Ubuntu:24.04:LTS | node-object-path | no fix listed | UBUNTU-CVE-2021-23434 |
| Ubuntu:25.10 | node-object-path | no fix listed | UBUNTU-CVE-2021-23434 |
| Ubuntu:26.04:LTS | node-object-path | no fix listed | UBUNTU-CVE-2021-23434 |
| Ubuntu:26.10 | node-object-path | no fix listed | UBUNTU-CVE-2021-23434 |
| npm | object-path | 0.11.6 | GHSA-v39p-96qg-c8rf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | object-path | unspecified – before 0.11.6 |
References
- https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423
- https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e8994ef154cab9eb
- https://github.com/mariocasciaro/object-path%230116
- [debian-lts-announce] 20230129 [SECURITY] [DLA 3291-1] node-object-path security update mailing-list