CVE-2020-15256: Prototype Pollution in object-path
Summary
CVE-2020-15256: Prototype pollution in object-path. Affects object-path versions < 0.11.5. Fixed in 0.11.5. How to fix ↓
Also tracked for
- node-object-path · Debian:11
The same CVE-2020-15256 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
object-path is an npm package that provides utility functions for working with JavaScript objects. It allows developers to manipulate and access nested properties of objects using a simple syntax. The package is widely used in JavaScript applications for tasks such as data manipulation and configuration management. However, versions of object-path up to 0.11.4 are vulnerable to a prototype pollution vulnerability in the set() method.
Vulnerability Detail
The prototype pollution vulnerability in object-path affects the set() method when the includeInheritedProps mode is enabled. This mode, available in versions >= 0.11.0, allows the modification of inherited properties in objects. By exploiting this vulnerability, an attacker can manipulate the prototype of an object, leading to unexpected behavior and potential security issues. The default operating mode of object-path is not affected if version >= 0.11.0 is used. However, any usage of set() in versions < 0.11.0 is vulnerable.
How To Fix
Minimum fixed version
0.11.5
This is the first release that contains the fix.
npm install object-path@0.11.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 0.11.5 is not feasible, a workaround is to avoid using the includeInheritedProps: true option or the withInheritedProps instance when using object-path version >= 0.11.0. By not enabling the includeInheritedProps mode, the vulnerability can be mitigated.
Conclusion
The prototype pollution vulnerability in object-path can lead to unexpected behavior and potential security issues. It is crucial to upgrade to version 0.11.5 or later to fix the vulnerability. Alternatively, developers can apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for object-path →
FAQ
object-path is an npm package that provides utility functions for working with JavaScript objects. It allows developers to manipulate and access nested properties of objects using a simple syntax.
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object. By manipulating the prototype, the attacker can introduce unexpected behavior and potentially exploit security vulnerabilities.
Versions of object-path up to 0.11.4 are affected by the prototype pollution vulnerability in the set() method.
To fix the vulnerability, it is recommended to upgrade to object-path version 0.11.5 or later. Alternatively, you can avoid using the includeInheritedProps: true option or the withInheritedProps instance if using object-path version >= 0.11.0.
Yes, a workaround is to avoid using the includeInheritedProps: true option or the withInheritedProps instance if using object-path version >= 0.11.0. By not enabling the includeInheritedProps mode, the vulnerability can be mitigated.
References
Related vulnerabilities
Recent vulnerabilities recorded for object-path.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
