depath and cool-path vulnerable to Prototype Pollution via `set()` Method

Description

janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.2

References

• GHSA-4h4x-4m75-47j4
• CVE-2024-38985
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• depath and cool-path vulnerable to Prototype Pollution via `set()` Method - depath - CVE-2024-38985
• dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() - CVE-2026-27837
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - CVE-2026-2950
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash.unset - CVE-2026-2950

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

cool-path