Vulnerability · Published Sep 1, 2021 · Assigned by snyk

CVE-2021-23438Prototype Pollution

Medium 5.6

In plain English

A medium-severity security flaw in mpath. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)1.7%top 22.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	mpath	0.8.4	GHSA-p92x-r36w-9395

Affected products (as reported)

Vendor	Product	Versions
n/a	mpath	unspecified – before 0.8.4

References

https://snyk.io/vuln/SNYK-JS-MPATH-1577289 x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548 x_refsource_MISC
https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc x_refsource_MISC