elijahharry/hoolock · Security
Prototype pollution not blocked by object-path related utilities in hoolock
- GHSA ID
- GHSA-4c2g-hx49-7h25
- CVE ID
- CVE-2024-23339
- Severity
- medium
- Published
- Updated
- CVSS
- 6.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- CVSS v3
- 6.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Description
Impact
Utility functions related to object paths (get, set and update) did not block attempts to access or alter object prototypes.
Patches
The get, set and update functions will throw a TypeError when a user attempts to access or alter inherited properties in versions >=2.2.1.
CWEs
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')