Executive brief
cached-path-relative is a JavaScript library for caching relative path computations. A prototype pollution vulnerability allows attackers to manipulate JavaScript object properties, potentially leading to unexpected behavior or information disclosure in applications that use this library with untrusted input.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the cached-path-relative npm library. The vulnerability exists because the cache variable is initialized as {} instead of Object.create(null), allowing access to the parent prototype chain. When an attacker provides a specially crafted path parameter (such as "proto") as input, the code accesses object attributes from the prototype instead of treating it as a path. This occurs in the cachedPathRelative function with no authentication required and network-reachable attack surface if the library processes untrusted input. An attacker can pollute the prototype chain to alter application behavior. The fix was released in version 1.1.0, which properly initializes the cache using Object.create(null).
Affected products
- npm cached-path-relative before 1.1.0
Timeline
- 2022-01-27: disclosed
- 2022-01-24: patched: Fix released in version 1.1.0