@thi.ng/paths Prototype Pollution vulnerability

Description

An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.

Recommendation

Update the @thi.ng/paths package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.1.63
• Patched version(s): 5.1.63

References

• GHSA-8ppr-www8-hfjx
• learn.snyk.io
• CVE-2024-29650
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @intlify/shared Prototype Pollution vulnerability - CVE-2024-52810
• @intlify/shared Prototype Pollution vulnerability (GHSA-hjwq-mjwj-4x6c) - CVE-2024-52810
• @intlify/shared Prototype Pollution vulnerability (GHSA-hjwq-mjwj-4x6c) 3 - CVE-2024-52810
• Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548

Tags:

npm

@thi.ng/paths