@thi.ng/paths Prototype Pollution vulnerability

Description

An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.

Recommendation

Update the @thi.ng/paths package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.1.63
• Patched version(s): 5.1.63

References

• GHSA-8ppr-www8-hfjx
• learn.snyk.io
• CVE-2024-29650
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• njwt Prototype Pollution vulnerability - CVE-2024-34273
• node-opcua-alarm-condition prototype pollution vulnerability - CVE-2024-57086
• vue-i18n has cross-site scripting vulnerability with prototype pollution (GHSA-9r9m-ffp6-9x4v) 2 - CVE-2024-52809
• vue-i18n has cross-site scripting vulnerability with prototype pollution (GHSA-9r9m-ffp6-9x4v) 3 - CVE-2024-52809

Tags:

npm

@thi.ng/paths