janryWang/depath

Releases0

Stars132

Path Matcher/Getter/Setter for Object/Array

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-38985 ↗	Mar 28, 2025Friday, 28 March 2025, 21:15	9.8 CRITICAL	—
janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.