CVE-2020-7708: Prototype Pollution in irrelon-path and @irrelon/path
Summary
CVE-2020-7708: Prototype Pollution in irrelon-path and @irrelon/path. Affects irrelon-path versions < 4.7.0. Fixed in 4.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package irrelon-path is an npm package that provides utility functions for working with paths in JavaScript. Similarly, the package @irrelon/path is also an npm package that offers path manipulation functions. Both packages are vulnerable to Prototype Pollution, a vulnerability that allows an attacker to modify the prototype of an object and introduce malicious properties or methods. This vulnerability exists in versions prior to 4.7.0 of both packages.
Vulnerability Detail
The Prototype Pollution vulnerability in irrelon-path and @irrelon/path is due to insecure handling of user-supplied input in the set, unSet, pushVal, and pullVal functions. An attacker can exploit this vulnerability by injecting specially crafted input that manipulates the prototype of an object, leading to unexpected behavior or arbitrary code execution. The impact of this vulnerability can range from data tampering to remote code execution, depending on how the affected package is used in an application.
How To Fix
Minimum fixed version
4.7.0
This is the first release that contains the fix.
npm install irrelon-path@4.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of irrelon-path and @irrelon/path to ensure the security of the application.
Conclusion
The Prototype Pollution vulnerability in irrelon-path and @irrelon/path can have severe consequences, ranging from data tampering to remote code execution. It is crucial to upgrade to version 4.7.0 or later of these packages to mitigate the vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for irrelon-path →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object and introduce malicious properties or methods. This can lead to unexpected behavior or arbitrary code execution.
The impact of this vulnerability can range from data tampering to remote code execution, depending on how the affected package is used in an application.
Versions of irrelon-path and @irrelon/path prior to 4.7.0 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to version 4.7.0 or later of irrelon-path and @irrelon/path. These versions contain the necessary patches to mitigate the Prototype Pollution vulnerability.
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of irrelon-path and @irrelon/path to ensure the security of the application.
