Executive brief
doc-path is a Node.js library for manipulating and accessing nested object properties using dot-notation paths. A prototype pollution vulnerability in versions before 2.1.2 allows attackers to pollute the Object prototype, potentially poisoning application behavior across all objects and enabling remote code execution or denial of service.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in doc-path before version 2.1.2, affecting the path manipulation logic. The vulnerability exists in the core path processing function (path.js line 54) where user-controlled input is merged into objects without proper sanitization of prototype keys like "__proto__", "constructor", or "prototype". An attacker can craft a malicious path string that pollutes the Object prototype, affecting all objects in the application. No authentication or user interaction is required; the vulnerability is exploitable over the network through any code that passes untrusted path input to doc-path functions. The impact can range from information disclosure and denial of service to remote code execution depending on how the application uses the polluted objects. A fix is available in version 2.1.2.
Affected products
- npm doc-path before 2.1.2
Timeline
- 2020-11-15: disclosed
- 2021-04-19: patched: version 2.1.2