CVE-2018-16490: Prototype Pollution in mpath
Summary
CVE-2018-16490: Prototype Pollution in mpath. Affects mpath versions < 0.5.1. Fixed in 0.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mpath is an npm package that provides utility functions for working with JavaScript objects and paths. It allows developers to manipulate and traverse object properties using dot notation. However, versions of mpath before 0.5.1 are vulnerable to prototype pollution. This means that certain input can be used to add or modify properties of the Object prototype, which will affect all objects in the application.
Vulnerability Detail
The vulnerability in mpath arises from a lack of proper input validation. By providing specific input, an attacker can pollute the Object prototype and introduce malicious properties that will be present on all objects in the application. This can lead to various security issues such as remote code execution, information disclosure, or denial of service attacks. It is important to note that this vulnerability is classified as moderate in severity (CWE-400).
How To Fix
Latest published version: 0.9.0 as of 23 Oct 2026
npm install mpath@0.9.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.1
This is the first release that contains the fix.
npm install mpath@0.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Prototype pollution in mpath (CVE-2018-16490) is a moderate severity vulnerability that allows an attacker to modify the Object prototype and introduce malicious properties. To mitigate this vulnerability, it is crucial to update to version 0.5.1 or later of mpath. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mpath →
FAQ
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, which can lead to unexpected behavior and security issues.
By providing specially crafted input, an attacker can manipulate the prototype of an object and introduce malicious properties that affect the behavior of the application.
Prototype pollution can lead to various security issues such as remote code execution, information disclosure, or denial of service attacks.
Yes, updating to version 0.5.1 or later of mpath fixes the prototype pollution vulnerability.
No, only versions before 0.5.1 are vulnerable to prototype pollution. It is recommended to update to the latest version to ensure the security of your application.
Related vulnerabilities
Recent vulnerabilities recorded for mpath.
