Executive brief
object-path is a popular Node.js library used to access and manipulate nested JavaScript object properties. A prototype pollution vulnerability in its del() function allows attackers to modify core Object properties without authentication, potentially affecting the behavior of all objects in an application and causing denial of service or data manipulation.
Technical details
object-path is vulnerable to prototype pollution (CWE-1321, CWE-915) due to improper validation in the del() function, which fails to restrict deletion of Object prototype attributes. An attacker can craft input that modifies Object.prototype properties (such as toString), affecting all downstream objects in the application. The vulnerability is network-accessible and requires no authentication or user interaction. Exploitation can lead to application denial of service or unintended behavior modification. The vulnerability was patched in version 0.11.8, available at commit 4f0903fd7c832d12ccbe0d9c3d7e25d985e9e884.
Affected products
- object-path object-path before 0.11.8
Timeline
- 2021-09-20: disclosed: Published in GitHub Advisory Database
- 2021-09-20: patched: Fixed in version 0.11.8