Log in Start free

Vulnerability · Published Jan 21, 2022 · Assigned by snyk

CVE-2021-23518Prototype Pollution

High 7.3

In plain English

A high-severity security flaw in cached-path-relative. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.9%top 19.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-cached-path-relative1.1.0+~1.0.0-1DEBIAN-CVE-2021-23518
Debian:13node-cached-path-relative1.1.0+~1.0.0-1DEBIAN-CVE-2021-23518
Debian:14node-cached-path-relative1.1.0+~1.0.0-1DEBIAN-CVE-2021-23518
Ubuntu:22.04:LTSnode-cached-path-relativeno fix listedUBUNTU-CVE-2021-23518
Ubuntu:24.04:LTSnode-cached-path-relativeno fix listedUBUNTU-CVE-2021-23518
Ubuntu:25.10node-cached-path-relativeno fix listedUBUNTU-CVE-2021-23518
Ubuntu:26.04:LTSnode-cached-path-relativeno fix listedUBUNTU-CVE-2021-23518
Ubuntu:26.10node-cached-path-relativeno fix listedUBUNTU-CVE-2021-23518
npmcached-path-relative1.1.0GHSA-wg6g-ppvx-927h

Affected products (as reported)

VendorProductVersions
n/a cached-path-relative unspecified – before 1.1.0

References