CVE-2020-7772: Prototype Pollution in doc-path
Summary
CVE-2020-7772: Prototype Pollution in doc-path. Affects doc-path versions < 2.1.2. Fixed in 2.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The doc-path package is an npm package used for manipulating file paths in JavaScript applications. It provides various functions to parse, modify, and manipulate file paths. The package is widely used in many projects and is an essential component for handling file paths in JavaScript applications.
Vulnerability Detail
This vulnerability, identified as CVE-2020-7772, is a prototype pollution vulnerability in the doc-path package before version 2.1.2. Prototype pollution is a type of vulnerability that allows an attacker to modify the behavior of existing objects or classes by injecting malicious properties into their prototypes. In the case of doc-path, this vulnerability could be exploited to manipulate file paths in unexpected ways, potentially leading to security breaches or data corruption. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
2.1.2
This is the first release that contains the fix.
npm install doc-path@2.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The doc-path package before version 2.1.2 is vulnerable to prototype pollution. It is crucial to update the package to version 2.1.2 or later to mitigate the risk of security breaches or data corruption. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for doc-path →
FAQ
Prototype pollution is a vulnerability that allows an attacker to modify the behavior of existing objects or classes by injecting malicious properties into their prototypes. It can lead to unexpected behavior, security breaches, or data corruption.
This vulnerability affects the doc-path package before version 2.1.2. It allows an attacker to manipulate file paths in unexpected ways, potentially leading to security breaches or data corruption.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, update the doc-path package to version 2.1.2 or later by running the command 'npm install doc-path@2.1.2' in your project directory.
No specific workaround is mentioned for this vulnerability. It is recommended to update the package to the fixed version.
