Executive brief
irrelon-path is a JavaScript library used for manipulating object properties via path notation. This vulnerability allows an attacker to pollute the JavaScript Object prototype through specific functions, potentially affecting all objects in an application and leading to unexpected behavior or security bypass in dependent code.
Technical details
The package contains a prototype pollution vulnerability in the set, unSet, pushVal, and pullVal functions that fail to validate path input against dangerous keys like "__proto__". An attacker can craft a malicious path string to modify the prototype chain of all JavaScript objects in the runtime. The vulnerability requires network reachability to a system using the library with untrusted input, but does not require authentication. The fix, released in version 4.7.0, adds explicit checks to reject "__proto__" paths before processing. This affects all versions prior to 4.7.0.
Affected products
- Irrelon irrelon-path before 4.7.0
- Irrelon @irrelon/path before 4.7.0
Timeline
- 2020-08-18: disclosed
- 2020-08-18: patched: Version 4.7.0 released with fix
- 2021-05-06: advisory: GitHub advisory GHSA-j7cg-h9v9-6vqp published