Prototype Pollution in node-forge util.setPath API

Description

forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.10.0
• Patched version(s): 0.10.0

References

• GHSA-wxgw-qj99-44c2

Related Issues

• Command Injection in lodash (GHSA-35jh-r3h4-6jhm) - CVE-2021-23337
• Bootstrap Cross-Site Scripting (XSS) vulnerability - CVE-2024-6531
• Prototype Pollution in node-forge - CVE-2020-7720
• Improper Verification of Cryptographic Signature in node-forge - CVE-2022-24772

Tags:

npm

node-forge