Prototype Pollution Vulnerability in node-pathval: CVE-2020-7751
Summary
CVE-2020-7751: pathval before version 1.1.1 is vulnerable to prototype pollution. Affects node-pathval across 2 version ranges.
< 1.1.0-4
< db6c3e39c39859564704b7f37149082689f1b172
Fixed in 1.1.0-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-pathval is a JavaScript library used for accessing and manipulating object properties using a path string. It is commonly utilized in various applications to simplify object property access. However, prior to version 1.1.1, node-pathval is susceptible to a prototype pollution vulnerability, which can lead to severe security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2020-7751, allows an attacker to manipulate the prototype of an object, potentially leading to unauthorized access or modification of sensitive data. This issue arises from improper handling of user input, enabling attackers to inject properties into the Object prototype. As a result, any object in the application can be affected, leading to potential data corruption, denial of service, or other malicious actions.
How To Fix
Minimum fixed version
1.1.0-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-pathvalTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider sanitizing user inputs to prevent prototype pollution. Implement checks to ensure that user-supplied paths do not contain malicious patterns that could lead to prototype manipulation.
Conclusion
CVE-2020-7751 is a significant vulnerability in the node-pathval package that can lead to severe security implications if not addressed. It is crucial for developers using this package to upgrade to the latest version or implement workarounds to safeguard their applications.
See every vulnerability recorded for node-pathval →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify an object's prototype, potentially affecting all instances of that object.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, data corruption, or denial of service in your application.
Yes, you can sanitize user inputs to prevent prototype pollution by implementing strict checks on the input paths.
The CVSS score for CVE-2020-7751 is 7.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-pathval.
