CVE-2024-36573: Prototype Pollution in @almela/obx
Summary
CVE-2024-36573: obx Prototype Pollution. Affects @almela/obx versions < 0.0.4. Fixed in 0.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @almela/obx package is an npm package that provides functionality for object manipulation and transformation. It is commonly used in JavaScript applications to simplify object operations. However, versions before v0.0.4 of @almela/obx are vulnerable to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to arbitrary code execution or unexpected behavior. In the case of @almela/obx, the vulnerability exists in the obx/build/index.js file, specifically in the reduce and Object.set components. An attacker can exploit this vulnerability to execute arbitrary code, potentially compromising the application's security.
How To Fix
Latest published version: 0.0.6 as of 22 Oct 2026
npm install @almela/obx@0.0.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.4
This is the first release that contains the fix.
npm install @almela/obx@0.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible.
Conclusion
The @almela/obx package before v0.0.4 is vulnerable to Prototype Pollution, which can lead to arbitrary code execution. It is crucial to update to version 0.0.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @almela/obx →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to arbitrary code execution or unexpected behavior.
The vulnerability affects versions before v0.0.4 of @almela/obx. An attacker can exploit this vulnerability to execute arbitrary code, potentially compromising the application's security.
To fix this vulnerability, update the @almela/obx package to version 0.0.4 or later.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-jj58-488v-4rgf/GHSA-jj58-488v-4rgf.json
