CVE-2020-7751: Prototype pollution in pathval
Summary
CVE-2020-7751: Prototype pollution in pathval. Affects pathval versions < 1.1.1. Fixed in 1.1.1. How to fix ↓
Also tracked for
- node-pathval · Debian:11
The same CVE-2020-7751 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is pathval, an npm package. It is used for validating and manipulating JavaScript object paths. The package allows developers to access and modify nested properties of objects using dot notation or array notation. The vulnerability affects all versions of pathval up to 1.1.1.
Vulnerability Detail
The vulnerability in pathval is related to prototype pollution. Prototype pollution is a type of vulnerability that occurs when an attacker can inject properties into an object's prototype. In the case of pathval, an attacker can manipulate the prototype of an object, leading to unexpected behavior or even remote code execution. This vulnerability has a CVSS score of 7.2, indicating a high severity level. It can be exploited by an attacker with high privileges, without requiring user interaction.
How To Fix
Latest published version: 2.0.1 as of 22 Oct 2026
npm install pathval@2.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.1
This is the first release that contains the fix.
npm install pathval@1.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version as soon as possible.
Conclusion
In conclusion, the pathval package is vulnerable to prototype pollution, which can lead to unexpected behavior or even remote code execution. It is crucial to update the package to version 1.1.1 or higher to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pathval →
FAQ
Prototype pollution is a vulnerability that allows an attacker to modify an object's prototype, leading to unexpected behavior or security issues.
An attacker can exploit this vulnerability by injecting malicious properties into an object's prototype, which can lead to remote code execution or other security issues.
Yes, all versions of pathval up to 1.1.1 are affected by this vulnerability. It is recommended to update to the latest version.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the only solution.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
