Executive brief
mpath is a JavaScript library used to access nested object properties via path strings. A prototype pollution vulnerability allows attackers to inject malicious code that modifies core JavaScript objects, potentially affecting all applications using mpath. This could lead to application logic being bypassed, data corruption, or execution of unintended code.
Technical details
mpath before version 0.5.1 is vulnerable to prototype pollution (CWE-1321), where specific inputs allow an attacker to add or modify properties on the Object prototype. Since the prototype chain is shared across all JavaScript objects, polluting it affects every object in the running process. The vulnerability is network-reachable with no authentication required, and an attacker can achieve integrity compromise by modifying critical object properties. The fix is available in version 0.5.1 and later.
Affected products
- mpath mpath <0.5.1
Timeline
- 2019-02-07: disclosed
- 0.5.1: patched