CVE-2021-23518: Prototype Pollution in cached-path-relative
Summary
CVE-2021-23518: Prototype Pollution in cached-path-relative. Affects cached-path-relative versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Also tracked for
- node-cached-path-relative · Debian:11
The same CVE-2021-23518 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package cached-path-relative is an npm package that provides functionality for creating cached relative paths. It is commonly used in JavaScript projects to manage file paths and directories. The vulnerability in the package arises from a flaw in the implementation of the cachedPathRelative function, where the cache variable is set as an empty object ({}) instead of using Object.create(null). This allows for potential Prototype Pollution attacks, where an attacker can modify the prototype of the cache object and manipulate its properties. The vulnerability has a CVSS score of 7.3, indicating a high severity level.
Vulnerability Detail
The vulnerability in cached-path-relative allows for Prototype Pollution attacks. When the cache object is used to create a cached relative path, if the origin path is set as proto, the attribute of the object is accessed instead of a path. This can lead to unauthorized access to parent prototype properties and potential manipulation of the cache object. The impact of this vulnerability can vary depending on the usage of the package in different applications. However, it has the potential to result in unauthorized access, data manipulation, or even remote code execution.
How To Fix
Latest published version: 1.1.0 as of 22 Oct 2026
npm install cached-path-relative@1.1.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround can be implemented by manually modifying the cachedPathRelative function in the package's source code. The cache variable should be initialized using Object.create(null) instead of {}. Here is an example of the modified code:
function cachedPathRelative() {
var cache = Object.create(null);
// rest of the function implementation
}
Conclusion
The cached-path-relative package before version 1.1.0 is vulnerable to Prototype Pollution, which can lead to unauthorized access, data manipulation, or remote code execution. It is crucial to update the package to the latest version (1.1.0 or later) to mitigate this vulnerability. If immediate update is not possible, a temporary workaround can be implemented by modifying the cachedPathRelative function. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cached-path-relative →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker is able to modify the prototype of an object, leading to unexpected behavior and potential security issues. In the context of cached-path-relative, Prototype Pollution allows for unauthorized access to parent prototype properties and potential manipulation of the cache object.
The impact of this vulnerability can vary depending on the usage of the cached-path-relative package in different applications. However, it has the potential to result in unauthorized access, data manipulation, or even remote code execution.
To fix this vulnerability, it is recommended to update the cached-path-relative package to version 1.1.0 or later. This can be done by running the command 'npm install cached-path-relative@latest' in your project's root directory.
If updating the package is not immediately feasible, a temporary workaround can be implemented by manually modifying the cachedPathRelative function in the package's source code. The cache variable should be initialized using Object.create(null) instead of an empty object ({}).
You can find more information about this vulnerability, including the complete advisory and technical details, on the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-wg6g-ppvx-927h/GHSA-wg6g-ppvx-927h.json
Related vulnerabilities
Recent vulnerabilities recorded for cached-path-relative.
