Executive brief
cached-path-relative is a Node.js library used for resolving relative file paths. A prototype pollution vulnerability in versions before 1.0.2 allows attackers to inject arbitrary properties into JavaScript objects, potentially leading to application denial of service or unexpected behavior in applications that depend on this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-20, CWE-400) affecting cached-path-relative versions before 1.0.2. Prototype pollution occurs when an attacker can inject malicious properties into the Object prototype through specially crafted input, which then affects all objects in the application. The attack is network-reachable and requires no authentication or user interaction. An attacker can exploit this to cause denial of service or modify application behavior. The fix is available in version 1.0.2 and later.
Affected products
- npm cached-path-relative before 1.0.2
Timeline
- 2018-09-07: disclosed
- 2018-11-07: patched: version 1.0.2 released
- 2018-11-07: advisory