Description
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ntharim dot-access
Default version status: unaffected
0 to ≤ 1.0.0affected
pkg:npm/dot-accessReferences
- https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2 ↗
- https://github.com/ntharim/dot-access/issues/5 ↗
- https://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L9-L18 ↗
- https://github.com/ntharim/dot-access ↗
- https://www.vulncheck.com/advisories/dot-access-through-1.0.0-prototype-pollution-via-set-path-argument ↗