@thi.ng/paths Prototype Pollution vulnerability

Description

An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.

Recommendation

Update the @thi.ng/paths package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.1.63
• Patched version(s): 5.1.63

References

• GHSA-8ppr-www8-hfjx
• learn.snyk.io
• CVE-2024-29650
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• vue-i18n has cross-site scripting vulnerability with prototype pollution - vue-i18n - CVE-2024-52809
• Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - CVE-2024-32866
• node-opcua-alarm-condition prototype pollution vulnerability - CVE-2024-57086
• Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - @conform-to/yup - CVE-2024-32866

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

@thi.ng/paths