Executive brief
depath and cool-path are JavaScript utility libraries for safely getting and setting nested object properties. A prototype pollution vulnerability in the set() method allows attackers to inject malicious properties into the Object.prototype, enabling them to disrupt application logic, trigger denial-of-service conditions, or potentially execute arbitrary code across the application.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) located in the setIn() function (lib/index.js:90) of depath and cool-path libraries. The set() method unsafely assigns properties from a source object to a destination object without validating or filtering special property names like __proto__ and constructor.prototype. An attacker can exploit this by passing specially crafted paths (e.g., "__proto__.polluted") to the setIn() or ensureIn() methods, which propagates malicious properties to Object.prototype and affects all JavaScript objects in the application. No authentication or special privileges are required; the vulnerability is reachable via direct library calls with untrusted input. Exploitation can lead to denial of service, XSS, or remote code execution depending on how the polluted properties are used by the application. As of the advisory date, no official patch has been released; users are advised to implement input sanitization blocking __proto__ and constructor.prototype.
Affected products
- janryWang depath <=1.0.6
- janryWang cool-path <=1.1.2
Timeline
- 2024-03-14: disclosed: Vulnerability reported as GitHub issue #11
- 2025-03-28: advisory: GHSA-4h4x-4m75-47j4 advisory published
- 2025-03-31: other: OSV database entry modified