Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2023-26139
7.5
HIGHCVSS v3
Severity scale
010
Description
Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “__proto__”.
underscore-keypath
NPMAdds Key-Path mechanism extensions for underscore
NPMAdds Key-Path mechanism extensions for underscore>= 0.0.11, >= 0.0.11, <= 0.9.3NVD
jeeeyul/underscore-keypath
GitHubKey-Path mechanism extensions for underscore
GitHubKey-Path mechanism extensions for underscore>= 0.0.11, >= 0.0.11, <= 0.9.3NVD